I had email hosting with webhosting nz. At 5am I got an automated email from cpanel saying a full access privilege API token had been added to the account. I immediately tried to login on the website but the entire client area was not working. Additionally the live chat wasn't working. I tried logging in to the specific server directly but the password had been changed. I tried to email them but their support email bounced all emails. I messaged them on facebook and got no response. There was no way to get in to shut it down and no way to contact them. It was like this for almost 6 hours. When I finally gained access to cpanel the API token was still there and I had to revoke it myself.

Since they never pulled down the mailserver for the hours it was compromised, I was able to mbsync down my emails, open accounts with a different provider, upload the mail there, then nuke all the emails in the webhostingnz mailboxes. I also deleted the mx records for my domains to prevent new messages being delivered to a compromised mailserver. I assume all of my emails were copied by the hackers, though. Dovecot virtual folders appeared in the mailboxes in question which I am assuming happened when the hackers were syncing my emails.

When webhostingnz's site was working again I logged in, cancelled my services and raised a ticket asking what the hell. I got a boilerplate email about a cpanel zero-day and how they prudently pulled down the servers while they waited for a patch from upstream then redeployed everything from backups which they claim prevented data leaks. This was blatantly false as my server (rosie.whsl206.com) never went down for a second and still contained the hacker's full-access API token when I logged in.

If anyone has anything hosted with them I would strongly suggest logging into cpanel, checking if there's an API token, changing all your passwords, then moving to a different hosting provider. I think it's safe to assume that 100% of their customer's data has been leaked. The fact there was no way to contact them for hours and they never pulled the hacked server down to try minimise data excursion is extraordinary.