Hackers Breached German Host Mittwald via Its MCP Server

An attacker spent eight days inside the systems of German web host Mittwald after entering through the very server customers use to connect AI assistants to their hosting platform. The intrusion, which began on Oct. 27 and was discovered on Nov. 4, compromised 56 customer projects, the company said.

Mittwald CM Service, based in Germany and hosting websites for web agencies, disclosed that the breach came through its Model Context Protocol (MCP) server — the interface customers use to link AI assistants to its mStudio hosting platform. The attacker read out session tokens belonging to users of that interface, though the company says no passwords were taken.

A stolen token carried its owner's full rights, meaning the attacker could reach every project that user could manage. The intruder disguised the preparations as normal user activity, which the company gives as the reason detection took about a week.

What happened on the timeline?

According to Mittwald's incident FAQ, the unauthorized access began on Oct. 27, and the company discovered it through its own analysis on Nov. 4. The next day, Nov. 5, Mittwald disabled mStudio logins, SSH access, extensions and orders, and confirmed the breach that afternoon.

The company then revoked all compromised session tokens, blocked some API keys, and took projects showing traces of the attacker offline. Access to mStudio and SSH returned on Nov. 7, though some precautionary website blocks remain in place.

The MCP server itself stays offline until further notice. Mittwald has not decided whether it will offer the service again and points customers to its command-line tool instead.

Why does the company blame AI?

Managing director Robert Meyer told customers in a blog post on Saturday that the attacker appeared to have used AI tools, citing logs that show the intruder moving through systems with only seconds between steps that would take a human far longer.

"The attacker disguised his access attempts and carried out various diversionary tactics," Meyer wrote. The company gave no other evidence of AI involvement and did not respond when asked by The Record how it distinguished AI tools from conventional scripts, which also move quickly.

Mittwald's timeline says the attacker first tested the MCP flaw in October, during the industry-wide rush to patch the PHP2Shell vulnerability. It remains unclear whether the flaw sat in Mittwald's own code or in open-source MCP libraries.

"First the PHP2Shell vulnerability, now the attack on our systems. AI attacks will become more frequent in the future," Meyer wrote.

What should affected customers do?

Mittwald says it has found no evidence that data was published and no indication of access to files, databases or mailboxes beyond what it will flag to individual customers. It advises anyone who used the MCP server after Oct. 27 to:

• Change passwords and enable two-factor authentication
• Delete unrecognized API keys and SSH keys
• Rotate credentials for databases, email and outside services stored in their projects

External forensic experts are assisting with the investigation, and the relevant authorities have been informed. Meyer said a detailed account of the incident will follow the next week.

Is this part of a wider pattern?

The breach follows other incidents in which AI tooling widened the attack surface for attackers and defenders alike. One earlier case involved a researcher's AI agent that escaped its sandbox and breached a sales tool at WorkOS.

For Mittwald, the commercial question is now whether it can restore confidence in AI-connected hosting at all. Until the company decides the fate of its MCP server, its customers will manage their projects the old way — by hand, and with a fresh set of credentials.