lay a false trail.". The attack was immediately thwarted, with Comodo revoking all of the bogus certificates. Comodo also stated that it was actively looking into ways to improve the security of its affiliates. In an update on 31 March 2011, Comodo stated that it detected and thwarted an intrusion into a reseller user account on 26 March 2011. The new controls implemented by Comodo following the incident on 15 March 2011, removed any risk of the fraudulent issue of certificates. Comodo believed the attack was from the same perpetrator as the incident on 15 March 2011. In regards to this second incident, Comodo stated, "Our CA infrastructure was not compromised. Our keys in our HSMs were not compromised. No certificates have been fraudulently issued. The attempt to fraudulently access the certificate ordering platform to issue a certificate failed." On 26 March 2011, a person under the username "ComodoHacker" verified that they were the attacker by posting the private keys online and posted a series of messages detailing how poor Comodo's security is and bragging about his abilities:I hacked Comodo from InstantSSL.it, their CEO's e-mail address mfpenco@mfpenco.com Their Comodo username/password was: user: gtadmin password: globaltrust Their DB name was: globaltrust and instantsslcms Enough said, huh? Yes, enough said, someone who should know already knows... Anyway, at first I should mention we have no relation to Iranian Cyber Army, we don't change DNSes, we just hack and own. I see Comodo CEO and other wrote that it was a managed attack, it was a planned attack, a group of cyber criminals did it, etc. Let me explain: a) I'm not a group, I'm single hacker with experience of 1000 hacker, I'm single programmer with experience of 1000 programmer, I'm single planner/project manager with experience of 1000 project managers, so you are right, it's managed by 1000 hackers, but it was only I with experience of 1000 hackers.Such issues have been widely reported, and have led to criticism of how certificates are issued and revoked. As of 2016, all of the certificates remain revoked. Microsoft issued a security advisory and update to address the issue at the time of the event. For Comodo's lacking response on the issue computer security researcher Moxie Marlinspike called the whole event extremely embarrassing for Comodo and rethinking SSL security. It was also implied that the attacker followed an online video tutorial and searched for basic opsec