The access lasted for about two hours, during which the homepage of noblogs.org was changed, and we cannot rule out that the attacker may have had access to the users' database, which contains the list of email addresses of the people who manage the blogs and their passwords (not in plain text).
No IP addresses, neither of those who write nor of those who read, are stored on the server.

Our blog Cavallette automatically publishes to our Mastodon profile, so a post written by the attacker was also reposted there.
We recommend that anyone with the Mastodon Autopost plugin enabled on their blog, as we do, immediately change the password of their social account and revoke Noblogs' authorization from Profile Settings → Account → Authorized Apps.

For now, noblogs.org is UP and online in read-only mode.