The Grandstream Device Management System (GDMS) cloud platform has been compromised. Multiple Managed Service Providers (MSPs) report that SIP credentials stored in GDMS have been stolen and misused internationally, including in the US.
Grandstream has sent an email acknowledging the breach but is still investigating the cause. They recommend changing your logins and SIP credentials immediately.
I have not received an email about it yet, but when I logged in this morning I did receive a notice about “unusual activity” and a message that I needed to change my SIP passwords.
Thank you for posting this… I likely wouldn’t have logged into my GDMS account until I had to provision another phone, which might be weeks or even months from now.
