Agreed -- it would be a great service to customers without 2FA enabled to inform them all directly that this is in-progress, not just the ones whose accounts ha

Agreed -- it would be a great service to customers without 2FA enabled to inform them all directly that this is in-progress, not just the ones whose accounts have already been successfully accessed. I know you wouldn't want to provoke panicked overreactions, or risk customers thinking that this indicates a flaw in NameCheap's security, but direct contact is essential for this kind of ongoing attack. > continue to update our customers through our blog and social media I'm not sure what percentage of your customers this will actually reach, but surely not a majority (certainly not me, anyway).