Rackspace Says Hackers Accessed Customer Data During Ransomware Attack (techcrunch.com) 10
Cloud computing giant Rackspace has confirmed hackers accessed customer data during last month's ransomware attack. From a report: The attack, which Rackspace first confirmed on December 6, impacted the company's hosted Exchange email environment, forcing the web giant to shut down the hosted email service following the incident. At the time, Rackspace said it was unaware "what, if any, data was affected." In its latest incident response update published on Friday, Rackspace admitted that the hackers gained access to the personal data of 27 customers. Rackspace said the hackers accessed PST files, typically used to store backup and archived copies of emails, calendar events and contacts from Exchange accounts and email inboxes.
Rackspace said about 30,000 customers used its hosted Exchange service -- which it will now discontinue -- at the time of the ransomware attack. "We have already communicated our findings to these customers proactively, and importantly, according to Crowdstrike, there is no evidence that the threat actor actually viewed, obtained, misused, or disseminated any of the 27 Hosted Exchange customers' emails or data in the PSTs in any way," said Rackspace. The company added that customers that haven't been contacted directly can "be assured" that their data was not accessed by attackers.
Rackspace said about 30,000 customers used its hosted Exchange service -- which it will now discontinue -- at the time of the ransomware attack. "We have already communicated our findings to these customers proactively, and importantly, according to Crowdstrike, there is no evidence that the threat actor actually viewed, obtained, misused, or disseminated any of the 27 Hosted Exchange customers' emails or data in the PSTs in any way," said Rackspace. The company added that customers that haven't been contacted directly can "be assured" that their data was not accessed by attackers.
Re:"It wuz de h4xX0rZ!" (Score:5, Informative)
Always just go to BleepingComputer's coverage for security stuff:
https://www.bleepingcomputer.c... [bleepingcomputer.com]
RSS feed https://www.bleepingcomputer.com/feed/ (Score:2)
RSS feed https://www.bleepingcomputer.c... [bleepingcomputer.com]
Re: "It wuz de h4xX0rZ!" (Score:3)
PST files?! (Score:1)
Re: (Score:2)
PST files are stored on local or shared drives - this doesn't jibe with them hosting a pure Exchange enviro.
And who uses PST files in 2023? Most companies killed them years ago.
There's some Grade-A bullshit in this update...
Re: (Score:2)
Re: (Score:2)
Yea that's weird. I know admins can export PSTs directly from exchange so maybe PSTs still hanging out in the temp folder? Just a guess there as I don't deal with Exchange servers enough to know how they handle the PST files after generated in this case. Or Rackspace is doing some back-end shenanigans to make their hosted Exchange environment work since Exchange was never really built to be a multi-tenant product?
Pretty obvious what they're doing. Their killing their Exchange environment and forcing everyone to move to another environment (probably Office365) rather than rebuild their exchange environment. Exporting all the mailboxes as .pst files is just to customers cant sue because they didn't get access to their data.