Slicehost (now under Rackspace) sent a very cryptic email a few weeks ago saying users needed to "migrate" their servers, but gave no reason why. Then this mai

Slicehost (now under Rackspace) sent a very cryptic email a few weeks ago saying users needed to "migrate" their servers, but gave no reason why. Then this mail went out on Friday: We are writing to update you on the migration you recently completed, and to provide more information about the reasons it was necessary. We know that migrations can be inconvenient, and we thank you for your patience. Now that the migrations are complete, there is nothing more that you need to do regarding this issue. When we announced the recent migrations, we explained that such measures are periodically required to promote the stability, performance, security, and feature-richness of our Slicehost platform. We were not able to share more information at the time, without putting you and other customers at risk. Now that the migrations have been completed, however, we want to provide you with the transparency that you expect from Slicehost. We now can tell you the timing of the migrations was driven by the need to fix a potential security issue. We discovered the issue in collaboration with an independent I.T. security consulting firm that tested our products. The security consultants used forensic techniques to examine the underlying physical disk in newly created instances. They discovered that, in certain use cases, random fragments of temporarily stored data could be left behind on the physical disk. In repairing this vulnerability, we have ensured that all data is wiped effectively whenever a customer vacates hard-drive space on a host machine. And through the migration that you and other customers have completed, we have cleaned up all fragments of remnant data. The security consulting firm that discovered this issue has performed follow-up testing and has found no remnant data on our environment. We know of no case of customer data being seen or exploited in any way by any unauthorized party. One reason is that the remnant data could not have been seen through normal use of slices, but would have had to be sought, using forensic techniques. It was not possible for anyone to specifically target a particular customer through this vulnerability, given the random and fragmented nature of the remnant data. Customers who encrypted sensitive data on slices would have faced no risk of exposure. If we had made this issue public earlier, we could have opened the door for a malicious user to exploit the vulnerability. For that reason, we decided to keep information about the vulnerability within our company — until now, when the issue has been fully resolved. Dealing with security issues is a constant in any type of computing or cloud-hosting provider. At Slicehost, we work to provide you with the safest, most-stable environment possible. We regularly consult with independent security consultants. We employ a large and growing staff of security specialists and IT engineers. We are proud of their work in repairing this vulnerability, and grateful for your patience. If you have questions, please reach out to your support team. We are here to serve you. Slicehost Support Support@Slicehost.com