I can tell which accounts were compromised by the IP
address the ftp session came from. When one artist
contacted us about his studio being changed, I searched
to see the last time he had logged in via ftp and then
looked at the IP address.
It seems that at least 5 accounts were broken into. Some
of these artists have already contacted me.
I am still working on a recovery. I hope to have ftp access
turned back on as soon as possible. WIll keep you updated.
-lile
(a webmaster@art.net)
ps. I went to RSA securitie's conference yesterday and talked
with alot of friends who are into computer security. They were
helpful... Am hoping to also attend BayLisa tonight and see
if any other friends have some suggestions.