Mittwald MCP Server Breach: An Attacker Used a Web Host's AI Assistant Connector to Compromise 56 Customer Projects, What Is Confirmed and What to Check

A German web hosting company, Mittwald, says an attacker broke in through the tool it built so customers could connect AI assistants to their hosting accounts, compromised 56 customer projects and went unnoticed for eight days. If your business has connected an AI assistant to your hosting, code or admin accounts, that connection is a door into those systems and needs the same scrutiny as any other login.

What happened in the Mittwald MCP server breach

Mittwald published its account on Saturday, November 7, 2026, signed by founder and managing director Robert Meyer. It names the company's MCP server as the entry point. MCP stands for Model Context Protocol, a standard that lets AI assistants use outside tools. Mittwald's developer guide shows customers could connect tools such as Claude, ChatGPT, GitHub Copilot and Cursor to mStudio, its platform for managing websites and hosting.

Mittwald's FAQ says session tokens were read, not passwords. A session token is the digital pass a service issues after you log in, so whoever holds one can generally act as you without the password. Mittwald says all of those tokens have been revoked and no longer work.

What is confirmed and what is only claimed

Everything here comes from Mittwald itself. We found no independent forensic report.

Stated by Mittwald as fact:

• The MCP server was the entry point and is offline until further notice.
• 56 projects were compromised.
• Session tokens were read and have been revoked. Passwords were not read.
• Mittwald treats all data from October 27 onward as compromised.
• A check of relevant platforms has found no published data.
• The Kundencenter customer portal and the websites managed in it were not affected.

Claimed, without public proof:

• That the attacker used AI tools.

Not known:

• What the flaw was, and whether it sat in Mittwald's own code or in a library it used.
• How the tokens were read and exactly what the attacker did inside the 56 projects.
• Who the attacker is and why they did it.
• Whether and when the MCP server will return.

Mittwald has promised a detailed account this week, once analysis and recovery are finished. We could not find it as of November 9.

Was the Mittwald attack really carried out with AI?

Two different AI stories are getting blurred. The first is that an AI assistant connector was the way in, and Mittwald states that plainly. The second is that the attacker used AI, and that is an inference. Meyer writes that the logs show only seconds passing between steps that would take a human much longer, which he says points to AI tools.

That is a reasonable suspicion, but ordinary scripts also move in seconds. The Record reports that Mittwald did not respond when asked to distinguish AI tools from conventional scripts. Treat the AI-attacker part as unproven.

Who is affected by the Mittwald breach?

The FAQ says you are affected only if you used the MCP server, and that affected customers receive a personal email. The status page says every user received a general notice and that users who were not directly affected need do nothing, although the FAQ still recommends two-factor login for them.

The FAQ also says that unless you are told otherwise personally, Mittwald currently has no indication that your files, databases or mailboxes were accessed. Set that beside its statement that it treats all data from October 27 onward as compromised, and wait for the full report before closing the matter.

What Mittwald customers should do this week

The first five steps come from Mittwald's FAQ for affected MCP users. The last two are our advice.

While the MCP server stays offline, Mittwald names its command line tool, the mittwald CLI, as the alternative.

How to check the AI connectors your business uses

This applies whoever hosts you. Mittwald has not said its design was at fault in any of these areas, so read this as general hygiene.

1. List every connection. Note each AI tool linked to hosting, code repositories, email, CRM or accounting, and who approved it.
2. Cut the permissions. Start read-only. The MCP security guidance lists wildcard scopes as a common mistake because a stolen broad token reaches far more.
3. Prefer short-lived logins. Mittwald's guide is a useful comparison: OAuth access tokens last about an hour, while API tokens are long-lived and rotated by hand.
4. Revoke what is unused. Remove access at the provider as well as in the AI tool.
5. Check the logs. Confirm you can see what each connector did, and when.
6. Question the vendor. Ask how tokens are stored, whether the connector is separated from the admin systems, whether it has been independently tested, and whether you can switch it off for your account.

Why this matters for a company network or website

An AI connector holds live access to the systems it touches, so a flaw in it can reach your hosting account without anyone guessing a password. It also collects access for many customers in one place, which makes it an attractive target.

Mittwald's timeline shows the attacker signing up like any other customer, and the flaw being exploited five minutes after the final registration. A feature open to anyone who registers must withstand hostile users from the first day. Eight days also passed before anyone noticed, which is a long time for stolen access to stay live.

Agencies carry extra exposure, because one account can hold many clients' sites. Mittwald's FAQ does not address data protection duties, so if your projects hold personal data, ask your legal adviser whether you must notify anyone. Stolen sessions are a wider problem too, as our post on device bound session credentials explains.

Mittwald MCP server breach questions people are asking

What is an MCP server?

It is a service that lets AI assistants use another system's tools and data through the Model Context Protocol. Mittwald's let assistants work with mStudio.

Was my Mittwald website hacked?

Mittwald says 56 projects were compromised and that affected customers receive a personal email. Sites in the Kundencenter were not affected. If you are unsure, check your email and the status page.

Were Mittwald passwords stolen?

Mittwald says no. It says session tokens were read and have since been revoked.

Is the Mittwald MCP server back online?

Not when we checked. The FAQ says it is offline until further notice, and the developer guide lists it as unavailable.

Did AI hack Mittwald?

Not proven. Mittwald infers AI use from the speed of steps in its logs and has published no other evidence.

Are MCP servers unsafe to use?

Not by nature, but each one is added access that must be secured and monitored. This case shows one being used as a way in.

The bigger lesson

Every integration you add is a new login path, even when it arrives as a helpful AI feature. Before you switch one on, decide who owns it, what it can touch and how you would turn it off in a hurry. That is the same discipline as knowing who patches your servers, applied to a newer kind of access.

Want someone to review how your accounts, servers and AI tools connect? See security hardening or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Mittwald incident post; Mittwald FAQ; Mittwald status page; Mittwald MCP developer guide; MCP security best practices; The Record.