It is ransomware:
Rackspace confirms outage was caused by ransomware attack (bleepingcomputer.com)
Rackspace has now confirmed that the outage of Exchange email services for its clients is being caused by a ransomware infection inside their systems – but they refer to this as “isolated disruption”. Which I think is a statement aimed at their shareholders and future clients, because the loss of your email if you are a Rackspace client is not an “isolated disruption” for you.
As I explained below, email is a vital system for all organisations (OK someone will now say they do not use email – but then I am wondering why they are reading this blog!) and is something that is easily outsourced to third parties, especially if you are a small organisation.
In the past we ran our own Exchange mail servers, both sitting in offices and sitting in a data centres, all of which required a lot of work. When anyone’s server had issues it was always a priority support call to get it fixed. Stressful. Then there was the internet issues, patching, back-ups etc..
So moving the both ours and client’s email services to cloud providers made sense. The first time one of those providers had issues was when we started to create fall back email solutions for clients. These vary by client, most are simple and provide a stand by service to keep things running, but that is what a business continuity plan requires.
Original Post
Rackspace are a big player when it comes to hosted services – so when they are hit by a cyber incident the fallout to their users s severe:
Rackspace rocked by ‘security incident’ in hosted Exchange • The Register
Rackspace email outage continues as migrations prove hard • The Register
When we set up business continuity plans for our clients, we always recommend a fall back email solution – I have to say many do not bother as it can seem complex to manage for something you never have to use. To illustrate how important I consider our email, we have an emergency email solution and all of our team know how it works – just in case.
Clive Catton MSc (Cyber Security) – by-line and other articles