FirstVDS told customers that on Oct 17 (12:27–22:34 Moscow time) attackers used a vulnerability in ISPsystem VMmanager 6 virtualization management to reach part of its infrastructure and copy files from customer virtual disks in read-only mounts — so guest VMs kept running with no attack traces inside them. FirstVDS says the haul targeted secrets: SSH keys/authorized_keys, password stores, cloud/DevOps creds (AWS/GCP/Azure/kubeconfig/Docker/Terraform, GitHub/GitLab/npm), app/DB configs and connection strings, crypto wallets/seeds/exchange API keys, OpenAI/Anthropic keys, browser cookies/passwords, shell histories, and backup passwords. Scope (how many customers) was not published. FirstVDS disabled external access to the management plane; ISPsystem issued interim patches but FirstVDS says the flaw is not fully fixed and the admin UI stays offline until a final fix. Customers who got notices are told to treat everything on affected servers as compromised, move crypto first, rotate all secrets, and watch cloud/repo/exchange logs. The Record (Oct 19) corroborated the company account.