Hosting firm says it lost all customer data after ransomware attack

Gandalf_The_Grey

Level 76
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Apr 24, 2016
6,603
Danish hosting firms CloudNordic and AzeroCloud have suffered ransomware attacks, causing the loss of the majority of customer data and forcing the hosting providers to shut down all systems, including websites, email, and customer sites.

The two brands belong to the same company and stated that the attack unfolded last Friday night. However, today's operational status remains highly problematic, with the firm's IT teams only managing to restore some servers without any data.

Moreover, the firm's statement clarifies that it won't be paying the threat actors a ransom and has already engaged with security experts and reported the incident to the police.

Unfortunately, the system and data restoration process isn't going smoothly, and CloudNordic says many of its customers have lost data that appears to be irrecoverable.

"Since we neither can nor wish to meet the financial demands of the criminal hackers for a ransom, CloudNordic's IT team and external experts have been working intensively to assess the damage and determine what could be recovered," reads CloudNordic's statement (machine translated)

"Sadly, it has been impossible to recover more data, and the majority of our customers have consequently lost all their data with us."

Both public notices include instructions on recovering websites and services from local backups or Wayback Machine archives.

Given the situation, the two hosting service providers previously recommended that heavily impacted customers move to other providers, such as Powernet and Nordicway.
 

codswollip

Level 23
Content Creator
Well-known
Jan 29, 2017
1,201
Their reluctance to engage the attacker is doubled-edged, as their client base departs for more "secure" providers, leaving them without income. There is no "win" possible.
the two hosting service providers previously recommended that heavily impacted customers move to other providers, such as Powernet and Nordicway.
Not sure I would take advice from this group.
 

pvsurfer

Level 1
Verified
Oct 20, 2019
32
I don't understand why they can't recover their customer data by restoring a backup? Surely they must do daily backups.
 

Gandalf_The_Grey

Level 76
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Apr 24, 2016
6,603
From the original article:
During a data center migration, those servers were connected to the broader network, allowing the attackers to access critical administrative systems, all data storage silos, and all backup systems.

Next, the attackers encrypted all server disks, including primary and secondary backups, corrupting everything without leaving a recovery opportunity.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top