A Dec. 2 ransomware attack at Rackspace Technology which the managed cloud hosting company took several days to confirm is quickly becoming a case study on the havoc that can result from a single well-placed attack on a cloud service provider.
The attack has disrupted email services for thousands of mostly small and midsize organizations. The forced migration to a competitor's platform left some Rackspace customers frustrated and desperate for support from the company. It has also already prompted at least one class-action lawsuit and pushed the publicly traded Rackspace's share price down nearly 21% over the past five days.
"While it's possible the root cause was a missed patch or misconfiguration, there's not enough information publicly available to say what technique the attackers used to breach the Rackspace environment," says Mike Parkin, senior technical engineer at Vulcan Cyber. "The larger issue is that the breach affected multiple Rackspace customers here, which points out one of the potential challenges with relying on cloud infrastructure." The attack shows how if threat actors can compromise or cripple large service providers, they can affect multiple tenants at once.
Rackspace first disclosed something was amiss at 2:20 a.m. EST on Dec. 2 with an announcement it was looking into "an issue" affecting the company's Hosted Exchange environment. Over the next several hours, the company kept providing updates about customers reporting email connectivity and login issues, but it wasn't until nearly a full day later that Rackspace even identified the issue as a "security incident."
By that time, Rackspace had already shut down its Hosted Exchange environment citing "significant failure" and said it did not have an estimate for when the company would be able to restore the service. Rackspace warned customers that restoration efforts could take several days and advised those looking for immediate access to email services to use Microsoft 365 instead. "At no cost to you, we will be providing access to Microsoft Exchange Plan 1 licenses on Microsoft 365 until further notice," Rackspace said in a Dec. 3 update.
The company noted that Rackspace's support team would be available to assist administrators configure and set up accounts for their organizations in Microsoft 365. In subsequent updates, Rackspace said it had helped and was helping thousands of its customers move to Microsoft 365.
On Dec. 6, more than four days after its first alert, Rackspace identified the issue that had knocked its Hosted Exchange environment offline as a ransomware attack. The company described the incident as isolated to its Exchange service and said it was still trying to determine what data the attack might have affected. "At this time, we are unable to provide a timeline for restoration of the Hosted Exchange environment," Rackspace said. "We are working to provide customers with archives of inboxes where available, to eventually import over to Microsoft 365."
The company acknowledged that moving to Microsoft 365 is not going to be particularly easy for some of its customers and said it has mustered all the support it can get to help organizations. "We recognize that setting up and configuring Microsoft 365 can be challenging and we have added all available resources to help support customers," it said. Rackspace suggested that as a temporary solution, customers could enable a forwarding option, so mail destined to their Hosted Exchange account goes to an external email address instead.
Rackspace has not disclosed how many organizations the attack has affected, whether it received any ransom demand or paid a ransom, or whether it has been able to identify the attacker. The company did not respond immediately to a Dark Reading request seeking information on these issues. In a Dec. 6. SEC filing, Rackspace warned the incident could cause a loss in revenue for the company's nearly $30 million Hosted Exchange business. "In addition, the Company may have incremental costs associated with its response to the incident."
Messages on Twitter suggest that many customers are furious at Rackspace over the incident and the company's handling of it so far. Many appear frustrated at what they perceive as Rackspace's lack of transparency and the challenges they are encountering in trying to get their email back online.
One Twitter user and apparent Rackspace customer wanted to know about their organization's data. "Guys, when are you going to give us access to our data," the user posted. "Telling us to go to M365 with a new blank slate is not acceptable. Help your partners. Give us our data back."
Another Twitter user suggested that the Rackspace attackers had also compromised customer data in the incident based on the number of Rackspace-specific phishing emails they had been receiving the last few days. "I assume all of your customer data has also been breached and is now for sale on the dark web. Your customers aren't stupid," the user said.
Several others expressed frustration over their inability to get support from Rackspace, and others claimed to have terminated their relationship with the company. "You are holding us hostages. The lawsuit is going to take you to bankruptcy," another apparent Rackspace customer noted.
Davis McCarthy, principal security researcher at Valtix, says the breach is a reminder why organizations should pay attention to the fact that security in the cloud is a shared responsibility. "If a service provider fails to deliver that security, an organization is unknowingly exposed to threats they cannot mitigate themselves," he says. "Having a risk management plan that determines the impact of those known unknowns will help organizations recover during that worst case scenario."
Meanwhile, the lawsuit, filed by California law firm Cole & Van Note on behalf of Rackspace customers, accused the company of "negligence and related violations" around the breach. "That Rackspace offered opaque updates for days, then admitted to a ransomware event without further customer assistance is outrageous, a statement announcing the lawsuit noted.
No details are publicly available on how the attackers might have breached Rackspace's Hosted Exchange environment. But security researcher Kevin Beaumont has said his analysis showed that just prior to the intrusion, Rackspace's Exchange cluster had versions of the technology that appeared vulnerable to the "ProxyNotShell" zero-day flaws in Exchange Server earlier this year.
"It is possible the Rackspace breach happened due to other issues," Beaumont said. But the breach is a general reminder why Exchange Server administrators need to apply Microsoft's patches for the flaws, he added. "I expect continued attacks on organizations via Microsoft Exchange through 2023."
Link:
Rackspace Incident Highlights How Disruptive Attacks on Cloud Providers Can Be - DARKReading
- Nigeria's Okra joins cloud hosting race to challenge AWS and Azure - Developing Telecoms - October 10th, 2024
- US Signal Introduces IaaS Solution OpenCloud for Open-Source Cloud Hosting - The Fast Mode - October 1st, 2024
- Waite Park hosting Coffee with a Cop on Wednesday - St. Cloud Live - October 1st, 2024
- Internet Vikings Approved to Offer VMware Private Cloud Hosting in Arizona - Cision News - August 23rd, 2024
- We wanted to become the Rolls-Royce of cloud hosting: Inside Hyve Managed Hostings global expansion plans - ITPro - July 20th, 2024
- Hostinger Review: VPS, Cloud, and Shared Hosting - Tom's Hardware - July 12th, 2024
- Optimizing Web Performance with Cloud Hosting - Spiceworks News and Insights - June 26th, 2024
- Oracle to open third Spanish cloud region with Telefonica as hosting partner - Telecompaper EN - June 26th, 2024
- Interior awards $2 billion cloud hosting contract to 7 vendors - FedScoop - June 5th, 2024
- From Clean Energy to Cloud Hosting: Bitcoin Miners Have Diverse Operations - Finance Magnates - June 5th, 2024
- Top 10 Cloud Hosting Providers in 2024: Plans, Prices, and Key Factors - mitechnews.com - May 27th, 2024
- Bare Metal Cloud Market Grows with Demand for High-Performance Hosting Solutions As Revealed In New Report - WhaTech - May 19th, 2024
- Ahrefs Joins Others in Suggesting That On-Premises Hosting Can Be More Cost Effective than Cloud - InfoQ.com - May 19th, 2024
- St. Cloud's Rainbow Wellness Collective Hosting Series of Events - WJON News - March 20th, 2024
- Safe in the Cloud: A Deep Dive Into Hosting Security Measures - AppleMagazine - February 11th, 2024
- Why Peachtree Cloud Hosting Is The Future Of Streamlined Accounting - WhaTech Technology and Markets News - January 13th, 2024
- Unravelling The Secrets Of Sage 50 Cloud Hosting: Everything You Need To Know - WhaTech Technology and Markets News - January 13th, 2024
- Gift a Blogger, Student, or Professional a Lifetime of Cloud Web Hosting With iBrave, Now Only $40 - PCMag - December 26th, 2023
- These are the factors you need to take into account for Cloud hosting - TechiExpert.com - December 26th, 2023
- Andrew Lobel: Tech Luminary's Perspective On Cloud Hosting And AWS Lightsail's Prowess - Business Manchester - December 18th, 2023
- Hostereo revolutionizes cloud hosting with user-centric solutions, Powered by Interhost B.V. - NL Times - December 10th, 2023
- What Are The Advantages and Drawbacks of Cloud Hosting and ... - Analytics Insight - November 24th, 2023
- Cloud Computing Hosting Service Market 2031 Insights with Key Innovations Analysis | Leading Companies Acce... - SeeDance News - October 17th, 2023
- Multi Cloud Hosting and its Impact on Businesses - Digital Journal - April 26th, 2023
- What is cloud hosting and how do you use it? - TechRadar - April 26th, 2023
- How QuickBooks Hosting on the Cloud Server Helps Businesses in ... - Universe News Network - April 26th, 2023
- Mayor of St. Cloud Hosting State of the City Address - KVSC-FM News - April 18th, 2023
- Moro Hub join hands with Indias Cloud4C to offer cloud hosting ... - Arabian Business - March 25th, 2023
- Build unlimited sites with this $86 cloud-based web hosting - Cult of Mac - March 25th, 2023
- The role of cloud hosting in digital transformation and cloud computing - HostReview.com - March 9th, 2023
- [Webinar] Cloud Utility Pricing: Reduce Hosting Costs and Go Green ... - JD Supra - March 1st, 2023
- Features of Cloud Hosting Services Offered By Hosting Companies - HostReview.com - March 1st, 2023
- Cloud Hosting Contracts | Freedom of Information - Ordnance Survey - February 21st, 2023
- Cost Comparison of Cloud Hosting vs Traditional Hosting: What You ... - HostReview.com - February 13th, 2023
- Google hosting in-person Cloud Next 23 this August - 9to5Google - February 5th, 2023
- Agreement inked to provide cloud, hosting services at Musandam ... - Times of Oman - January 28th, 2023
- St. Cloud State Huskies have ended their losing streak after 0-2 vs ... - The Rink Live - January 28th, 2023
- Rise in Cyber Attacks Expected in 2023: Passwords and Cloud ... - TECH dot AFRICA - January 28th, 2023
- How to Find the Best Web Host for Your Business - The Yucatan Times - January 28th, 2023
- Here Are 2 Technology Stocks of the Future You Can Buy Today - The Motley Fool - January 28th, 2023
- What is PSaaS and is it Worthwhile? - Security Boulevard - January 28th, 2023
- Business was always a way of serving people - New Hampshire Business Review - January 28th, 2023
- Squire Patton Boggs assists in the acquisition of Sered - Iberian Lawyer - January 28th, 2023
- Whats Ahead for the Future of Data Streaming? - DevOps.com - January 28th, 2023
- How to create a new project in the self-hosted version of Orangescrum - TechRepublic - January 28th, 2023
- The Global Access Control as a Service (ACaaS) Market size is expected to reach $2.3 billion by 2028, rising at a market growth of 15.0% CAGR during... - January 28th, 2023
- Amazon wanted to discuss opportunities for fine-tuning NZs policy ... - New Zealand Herald - January 28th, 2023
- 3 Reasons Why Wall Street Analysts Think Amazon Stock Could ... - The Motley Fool - January 28th, 2023
- OnePlus Cloud 11 launch event: Heres everything OnePlus is launching in India on February 7 - Times Now - January 28th, 2023
- Auckland's giant new data centres - and the power they'll chug - New Zealand Herald - January 28th, 2023
- Octo Consulting Group, Inc. | U.S. - Government Accountability Office - January 28th, 2023
- The Venture Leaders Mobile 2023 kick off their roadshow to the ... - Venturelab - January 28th, 2023
- Demand for Server Virtualization Software Rises as Cloud and OS Technologies Proliferate: Fact.MR Exclusive Analysis - Yahoo Finance - January 20th, 2023
- Sabre CIO on the impact of cloud in travel - PhocusWire - January 20th, 2023
- cPanel Partners With CloudFest to Bring CloudFest USA Back to ... - InvestorsObserver - January 20th, 2023
- Basecamp details 'obscene' $3.2 million bill that caused it to quit the cloud - The Register - January 20th, 2023
- Microsoft set to make 5% of workforce redundant - Information Age - January 20th, 2023
- Who Owns the Generative AI Platform? - Andreessen Horowitz - January 20th, 2023
- 3 Warren Buffett Stocks That Could Soar 33% to 80% in 2023 ... - The Motley Fool - January 20th, 2023
- Earth Bogle: Campaigns Target the Middle East with Geopolitical ... - Trend Micro - January 20th, 2023
- Many businesses are set to spend big to raise their security game - TechRadar - January 20th, 2023
- Nvidia and 2 Other Stocks That Could Be Helped or Hurt by ChatGPT - Barron's - January 20th, 2023
- ESGold Welcomes Mr. Pierre-Olivier Mathys to its Advisory Board - TheNewswire.ca - January 20th, 2023
- How Has the Ramsar Convention Shaped China's Wetland ... - Sixth Tone - January 20th, 2023
- Chengdu Science Fiction Museum by Zaha Hadid Architects to host ... - Archilovers.com - January 20th, 2023
- Why I Bought This Promising Cloud Computing Stock - The Motley Fool - January 4th, 2023
- Brighton cloud company bringing 100 new skilled jobs to city - The Argus - January 4th, 2023
- Apache Iceberg promises to change the economics of cloud-based data analytics - The Register - January 4th, 2023
- MSP vs Vms: What Are the Differences? - StartupGuys.net - January 4th, 2023
- 5 Unstoppable Metaverse Stocks to Buy in 2023 - The Motley Fool - January 4th, 2023
- Top 10 Middle East IT stories of 2022 - ComputerWeekly.com - January 4th, 2023
- Potential cloud protests and maybe, finally, more JADC2 jointness ... - Breaking Defense - January 4th, 2023
- Double Down On Innovation With Edge Computing | - Spiceworks News and Insights - December 27th, 2022
- Simplifying digital sovereignty in a multi-cloud world - The Register - December 27th, 2022
- The Global IT Services Market size is expected to reach $2,013.6 billion by 2028, rising at a market growth of 8.4% CAGR during the forecast period -... - December 27th, 2022
- St. Cloud hockey games scheduled in honor of player killed in crash - SC Times - December 27th, 2022
- 2 Metaverse Stocks That Could Make You Richer in 2023 - The Motley Fool - December 27th, 2022
- EDNS inks a partnership deal with Alibaba Cloud to explore the ... - PR Newswire - December 27th, 2022
- Looking for a Surefire Winner in the Next Bull Market? Buy Amazon ... - The Motley Fool - December 27th, 2022
- Bank of England mulls future regulatory oversight over Ethereum ... - Ledger Insights - December 27th, 2022