01 — Overview
Executive summary
In September 2025, Expanse Host experienced a security incident affecting our previous Pterodactyl-based game management environment. An unauthorized party obtained administrative access to the panel for a limited period and abused administrative functionality, including the Pterodactyl Application API, to perform destructive actions against customer server instances.
We responded by taking the affected panel environment offline and beginning containment and recovery procedures.
Confirmed exposure
Customer email addresses contained within the panel were exposed. This was confirmed when the unauthorized party used those addresses to contact customers directly.
Our investigation found no evidence that customer game-server files or databases were exfiltrated. Monitoring available from the affected period did not indicate the large outbound data transfers that would have accompanied bulk extraction of the several terabytes of customer server data hosted at the time. Billing and payment systems were not affected.
Provider-managed backups allowed us to recover 100% of paying customer server data, with recovery points approximately four hours prior to the destructive activity. Across all services, including free and non-paying services without the same managed backup coverage, approximately 80–90% of server data was ultimately recovered.
Since the incident, we have made substantial changes to our platform, backup architecture, administrative security, vulnerability management, monitoring and incident-response processes.
02 — Incident
What happened
During the incident, an unauthorized party obtained administrative access to our Pterodactyl game panel. The access existed for a limited period. Once the incident was detected, the panel was taken offline as part of our containment response.
The attacker used administrative capabilities, including the Pterodactyl Application API, to initiate server deletions across the platform.
Our investigation did not identify a compromise of the underlying Wings infrastructure or our separately secured database infrastructure. Our billing and payment systems were also separate from the affected environment and were not compromised.
The primary impact was destructive disruption to hosted services rather than evidence of bulk extraction of customer server data.
03 — Investigation
CVE-2025-49132 and the security patch
We are aware of claims that Expanse knowingly left the Pterodactyl vulnerability CVE-2025-49132 unpatched prior to this incident. That characterization is inaccurate.
Fix received
Approximately June 18, 2025
Fix deployed
June 19, 2025
A targeted security hotfix was deployed rather than immediately performing a complete platform upgrade because the broader upgrade introduced compatibility issues with third-party extensions used by our panel at the time. The relevant security remediation itself was nevertheless applied.
We cannot conclusively establish the initial access vector used to obtain administrative access during the September compromise.
Although CVE-2025-49132 was initially considered in investigating the incident, the relevant security fix had already been deployed. We do not believe it would be responsible to state as fact that it was the confirmed entry point without sufficient forensic evidence.
What we can establish is that an unauthorized party obtained administrative panel access and subsequently abused administrative functionality to carry out destructive actions.
04 — Impact
Customer data exposure
We want to distinguish between account information and customer server data, as these have occasionally been conflated in discussions surrounding the incident.
Customer email addresses
Customer email addresses stored within the affected panel were exposed. The unauthorized party later contacted customers directly using these addresses and claimed they had “safeguarded” customer data. We therefore do not characterize the exposure as theoretical. Affected customers were contacted by Expanse, and account credentials were rotated or reset.
Customer server data
Our investigation found no evidence that customer game-server files or server databases were downloaded or exfiltrated. At the time, Expanse hosted several terabytes of customer server data; available infrastructure monitoring showed no corresponding bulk outbound bandwidth activity indicating extraction of this dataset.
This does not mean we can forensically prove that no individual file was ever accessed. Based on the evidence available to us, we found no indication of bulk customer server-data exfiltration.
Billing and payment information
Expanse's billing and payment infrastructure was separate from the affected game-panel environment. We found no evidence that these systems were compromised as part of this incident.
05 — Restoration
Recovery
The destructive activity resulted in customer server instances being deleted from the active game-server environment. Fortunately, our backup infrastructure operated independently of individual customer servers.
At the time, Expanse maintained provider-level backups of production nodes. These allowed us to reconstruct and restore the overwhelming majority of affected services.
100%
of paying customer server data was recovered
The applicable recovery point was approximately four hours before the incident, significantly limiting data loss for restored services.
Across the entire affected service base—including free and other non-paying services—approximately 80–90% of server data was recovered. Certain free and non-paying services did not include the same provider-managed backup coverage provided to paying services. Where provider backups were unavailable, recovery depended on backups maintained independently by the user.
06 — Response
Customer communication and response
Following discovery of the incident, Expanse:
- Took the affected panel environment offline
- Began containment and recovery procedures
- Notified affected customers
- Rotated and reset account credentials
- Restored eligible services from provider backups
- Reported the incident through relevant UK and US cybercrime and law-enforcement channels
We also assessed the information available to us regarding the scope of the incident and continued investigating the possibility of unauthorized data access.
07 — Remediation
What we changed
Restoring services was only part of our response.
The incident exposed weaknesses in how much destructive capability could be exercised through a compromised administrative control plane. Over the months that followed, we redesigned substantial portions of our management and security infrastructure around that lesson.
Polaris
We transitioned from our previous stock Pterodactyl deployment to Polaris, our internally developed management platform built around a controlled Pterodactyl backend. Polaris gives us substantially greater control over authentication, authorization, administrative operations and security monitoring.
Protections now prevent a single administrative session or API credential from easily performing the type of mass destructive activity seen during the incident. Sensitive administrative and API operations are logged for security review.
Privileged access
Administrative access has been substantially restricted. Staff accounts require two-factor authentication, administrative privileges are limited, and critical management infrastructure is protected by additional network-level access controls.
For security reasons, we do not publicly document the complete architecture or implementation of these controls.
Backup architecture
Customer service data is automatically backed up off-site every 24 hours. Our retention strategy includes an immutable daily recovery copy and separately retained weekly and monthly recovery points.
Deletion protections and immutability controls are designed so that compromise of production management systems cannot destroy historical recovery copies alongside production services. Recovery procedures are regularly exercised.
Vulnerability management
We developed an internal vulnerability-management system to continuously track security vulnerabilities relevant to our infrastructure.
The system monitors relevant CVEs, identifies potentially affected technologies and assists our team in prioritizing remediation based on exposure and severity.
Monitoring and auditability
We have significantly expanded infrastructure-wide monitoring, security logging and alerting.
Administrative activity, API operations and relevant infrastructure events are recorded to provide earlier detection and substantially better forensic visibility.
Incident response
We established a defined internal incident-response procedure covering containment, credential rotation, recovery, investigation and customer communication.
We will continue expanding this procedure as our infrastructure and customer base grow.
08 — Clarification
Clarification of public claims
We generally avoid responding publicly to speculation surrounding security incidents. However, several claims about this incident have continued circulating and we believe customers deserve a factual clarification.
“Expanse ignored the Pterodactyl RCE and didn’t patch its panel.”
The security remediation associated with CVE-2025-49132 was deployed before the September incident. A targeted security hotfix was used because a broader upgrade created compatibility problems with third-party extensions in use at the time.
We reject the characterization that the known security vulnerability was simply ignored.
“A large amount of customer data was downloaded.”
Our investigation found no evidence supporting claims of bulk customer server-data exfiltration. Customer email addresses were exposed, and we acknowledge that explicitly. The unauthorized party demonstrated possession of those addresses by contacting customers.
That should not be conflated with evidence that several terabytes of customer game-server data were downloaded. Our monitoring showed no corresponding bulk outbound transfer, and we found no other evidence indicating such an extraction occurred.
“Expanse did nothing beyond making a Discord announcement.”
The affected environment was taken offline, credentials were rotated, customers were contacted directly, recovery operations were performed using provider backups, and the incident was reported to the relevant cybercrime authorities in the UK and US, as well as through other appropriate law-enforcement channels. The infrastructure and security changes described above were subsequently implemented as part of the longer-term response.
09 — Commitment
Moving forward
We recognize that customers trusted Expanse with their services and their data. Regardless of the actions of the individuals responsible for the attack, preventing one compromised administrative environment from causing widespread disruption is ultimately part of our responsibility as a hosting provider.
The incident changed how we approach that responsibility.
Our objective since then has not simply been to ensure that the exact same attack cannot happen again. We have worked toward an architecture where administrative compromise, destructive actions, software vulnerabilities and infrastructure failures are assumed to be possibilities—and where independent controls limit their potential impact.
That means maintaining recoverable and immutable copies of customer data, restricting privileged access, monitoring administrative activity, continuously evaluating vulnerabilities affecting our infrastructure, and improving our ability to investigate and respond when something goes wrong.
Security is not something we consider complete following these changes. These systems and procedures will continue to evolve alongside Expanse.
We are publishing this retrospective both to provide customers with a clearer account of the 2025 incident and to correct inaccurate information that has circulated since it occurred.
Expanse Host