Mittwald CM Service, a hosting provider for web agencies based in North Rhine-Westphalia, disclosed in a blog post Saturday that hackers had compromised 56 customer projects after going undetected on its systems for eight days. The company’s managing director Robert Meyer said the attackers exploited a flaw in Mittwald’s Model Context Protocol (MCP) server used to allow customers to connect their AI assistants to mStudio, a platform for managing websites and hosting services.
It is unclear whether the flaw was in the company’s own code or in the open-source MCP software libraries. Meyer said the attacker appeared to have used AI tools in the breach, explaining the company’s logs “show that he worked his way through our system extremely quickly” and that “in some cases, only seconds passed between steps that would take significantly longer for a human attacker.” Mittwald provided no other evidence of AI involvement.
