Rackspace's Response To Ransomware Attack - CRN In Depth

In this week’s episode of CRN In Depth, Jay Fitzgerald, senior editor of the cybersecurity beat, shares Rackspace Technology’s response to a ransomware attack that led the multi-cloud company to experience a massive outage.

Rackspace Technology confirmed Tuesday morning what many others have suspected since a massive outage first hit the multicloud technology company last Friday: its current woes were caused by a ransomware attack.

The San Antonio, Texas-based Rackspace, which has been harshly criticized on social media for its lack of transparency since its massive outage started late last week, announced in a blog post that a “ransomware incident” affecting its hosted Exchange environment was indeed the cause of the loss of email services for thousands of customers.

“Alongside the Rackspace Technology internal security team, the company has engaged a leading cyber defense firm to investigate,” the company said in the statement.

“Our investigation is still in its early stages, and it is too early to say what, if any, data was affected. If we determine sensitive information was affected, we will notify customers as appropriate.”

The company added: “Based on the investigation to date, Rackspace Technology believes that this incident was isolated to its Hosted Exchange business. Rackspace Technology’s other products and services are fully operational, and the company has not experienced an impact to its Email product line and platform.”

But the company is acknowledging that an unknown number of hosted Exchange customers are still without email services – more than four days after the initial outage.

“Rackspace is making available resources so that customers can migrate their users and domains to Microsoft 365,” it said in its blog post.

“At this time, we are unable to provide a timeline for restoration of the Hosted Exchange environment. We are working to provide customers with archives of inboxes where available, to eventually import over to Microsoft 365.”

The company once again provided guidance on how customers can obtain temporary solutions while they try to migrate to Microsoft 365.

And Rackspace acknowledged the widespread criticism aimed at the company since last Friday.

“We understand the frustration this situation has caused for our customers and are doing everything we can to support them in migrating to Microsoft 365,” it said Tuesday. “We have surged our support staff and will be taking additional steps to help guide our customers through this process in order to limit the impact to their own operations.”

In a press release, the company said the incident is getting costly.

“Although Rackspace Technology is in the early stages of assessing this incident, the incident has caused and may continue to cause an interruption in its Hosted Exchange business and may result in a loss of revenue for the Hosted Exchange business, which generates approximately $30 million of annual revenue in the Apps & Cross Platform segment,” the press release reads.

“In addition, Rackspace Technology may have incremental costs associated with its response to the incident.”

[CasiodorusRex]

The only response should have been turn off the servers and restore from backups.