HostDzire Hit by Ransomware Attack

nabin

@Motion3549 but got same IPv4.

Falzo

@DjIcE said:

@JohnFilch123 said:
Gosh guys, just chill. Drink water, go outside, exercise. You will get your precious VPS.

you wouldnt say that when you missing your 4 figures a week.. 3 days of wrok down the drainage, and still not even a single perosn gotten their servers back.

So you earn >$1000 a week from a VM that probably isn't even $10 a week?
So cost is is about 1% or less?
And yet you wouldn't spent another 1% on a failover as redundancy?

Greed eats brain... you truly deserve to be the last one provisioned.

rpqu

@avsisp said:

@AlteredParadox said:

@JohnFilch123 said:

@AlteredParadox said: The amount of people on LET who pay for one relatively cheap box

But you do not understand, I am losing gazillions

Like... I'm not running anything business/production critical on mine, so I do nightly backups and if i need something back ill restore it to a new box - but to @avsisp point, if you were... exactly what he said. I still think a middle ground for some of the clueless folks would be a place that has a managed offering and offsite backups, but I don't disagree with him at all that the proper way to do it is keeping everything replicated and ready to go

If you can't do another provider entirely, many people already have a backup storage for their phones or laptops already -- at least the DB dump on a cron + file system parts used in a tar.gz could be easily nightly backup to that. Most provide Linux plugins - ---for example Google Drive I KNOW you can easily integrate into your Linux box...

I'm not asking people to spend million on duplicate VMs - don't get me wrong - it depends on your own downtime risk tolerance, ability to respond fastly and fix it, and TTL of your own DNS entries and so on.

People don't understand that if it data is lost, it's likely lost forever. If the data is that valuable, then pour money and effort to protect it

atkl

@DjIcE said:
you wouldnt say that when you missing your 4 figures a week.. 3 days of wrok down the drainage, and still not even a single perosn gotten their servers back.

??? You are missing 4 figures a week and you are still waiting (whining) here?

I would have immediately signed-up with another host and put back my business online

CloudHopper

@Falzo said:

@DjIcE said:

@JohnFilch123 said:
Gosh guys, just chill. Drink water, go outside, exercise. You will get your precious VPS.

you wouldnt say that when you missing your 4 figures a week.. 3 days of wrok down the drainage, and still not even a single perosn gotten their servers back.

So you earn >$1000 a week from a VM that probably isn't even $10 a week?
So cost is is about 1% or less?
And yet you wouldn't spent another 1% on a failover as redundancy?

Greed eats brain... you truly deserve to be the last one provisioned.

The VM is likely less than $1 week, so the cost would be less than 0.1% a week

allthemtings

@Falzo said:

@DjIcE said:

@JohnFilch123 said:
Gosh guys, just chill. Drink water, go outside, exercise. You will get your precious VPS.

you wouldnt say that when you missing your 4 figures a week.. 3 days of wrok down the drainage, and still not even a single perosn gotten their servers back.

So you earn >$1000 a week from a VM that probably isn't even $10 a week?
So cost is is about 1% or less?
And yet you wouldn't spent another 1% on a failover as redundancy?

Greed eats brain... you truly deserve to be the last one provisioned.

Same vibes

sanchogodinho

@Void said:

@sanchogodinho said:

@Mainfrezzer said:

@sanchogodinho said:

@HostDZire said:

@mehargags said:
@HostDZire pls do keep us posted... at least we will know if any progress and if you guys are onto something. Thanks and good luck

Yes will do for sure.
Next step is reinstall all the servers and setup it from scratch, so it will take sometime.
But we will do as fast we can.

What about the data? Have they threatened to make it public?

I think you're mixing things up. Ransomware is encrypting your files and demanding money to decrypt it again. (Which I find funny still works as you should never do that lmao).

*There might be a handful of cases where they might exfiltrate data, like employe data or patient data, but usually that's more of a classic breach. Nobody would ever bother downloading a shitload of vdisks.

I thought some Ransomware groups were to also threaten to make all the data public if the amount is not paid.

What data will they make public in this case ?

Well any sensitive information you have on the VPS. Like maybe environment variables, SSH keys, PII info, etc. When I searched it up on Google it said that modern ransomware attackers do such things.

Void

@sanchogodinho said:

@Void said:

@sanchogodinho said:

@Mainfrezzer said:

@sanchogodinho said:

@HostDZire said:

@mehargags said:
@HostDZire pls do keep us posted... at least we will know if any progress and if you guys are onto something. Thanks and good luck

Yes will do for sure.
Next step is reinstall all the servers and setup it from scratch, so it will take sometime.
But we will do as fast we can.

What about the data? Have they threatened to make it public?

I think you're mixing things up. Ransomware is encrypting your files and demanding money to decrypt it again. (Which I find funny still works as you should never do that lmao).

*There might be a handful of cases where they might exfiltrate data, like employe data or patient data, but usually that's more of a classic breach. Nobody would ever bother downloading a shitload of vdisks.

I thought some Ransomware groups were to also threaten to make all the data public if the amount is not paid.

What data will they make public in this case ?

Well any sensitive information you have on the VPS. Like maybe environment variables, SSH keys, PII info, etc. When I searched it up on Google it said that modern ransomware attackers do such things.

Yeah, ransomware operators do that, but I believe in this case they would have to go through hundreds or thousands of VMs looking for such data. Still that probably is not enough to put pressure on the provider to pay.

Mainfrezzer

@Void said:

@sanchogodinho said:

@Void said:

@sanchogodinho said:

@Mainfrezzer said:

@sanchogodinho said:

@HostDZire said:

@mehargags said:
@HostDZire pls do keep us posted... at least we will know if any progress and if you guys are onto something. Thanks and good luck

Yes will do for sure.
Next step is reinstall all the servers and setup it from scratch, so it will take sometime.
But we will do as fast we can.

What about the data? Have they threatened to make it public?

I think you're mixing things up. Ransomware is encrypting your files and demanding money to decrypt it again. (Which I find funny still works as you should never do that lmao).

*There might be a handful of cases where they might exfiltrate data, like employe data or patient data, but usually that's more of a classic breach. Nobody would ever bother downloading a shitload of vdisks.

I thought some Ransomware groups were to also threaten to make all the data public if the amount is not paid.

What data will they make public in this case ?

Well any sensitive information you have on the VPS. Like maybe environment variables, SSH keys, PII info, etc. When I searched it up on Google it said that modern ransomware attackers do such things.

Yeah, ransomware operators do that, but I believe in this case they would have to go through hundreds or thousands of VMs looking for such data. Still that probably is not enough to put pressure on the provider to pay.

Yeah the download would take ages and they probably get noticed before they would have done anything.

It would be more of a possibility if they had breached customer data so they could try to extort the customer directly to get their data back. Although unlikely.

barbarza

@itachikonoha said:

@DjIcE said:

@JohnFilch123 said:
Gosh guys, just chill. Drink water, go outside, exercise. You will get your precious VPS.

you wouldnt say that when you missing your 4 figures a week.. 3 days of wrok down the drainage, and still not even a single perosn gotten their servers back.

If it is that important, then you shouldn't rely on one server. Except wife, you should always have a backup of everything.

I have backup wives

Mainfrezzer

@barbarza said:

@itachikonoha said:

@DjIcE said:

@JohnFilch123 said:
Gosh guys, just chill. Drink water, go outside, exercise. You will get your precious VPS.

you wouldnt say that when you missing your 4 figures a week.. 3 days of wrok down the drainage, and still not even a single perosn gotten their servers back.

If it is that important, then you shouldn't rely on one server. Except wife, you should always have a backup of everything.

I have backup wives

ah the good ol 3-2-1

ehco

God bless

DjIcE

nice , still nothing, no replacement

AlteredParadox

@DjIcE said:
nice , still nothing, no replacement

Why don't you just cancel and move somewhere else at this point, if you're so unhappy? Do you really think posting "STILL WAITING" here over and over again is helping anything?

plumberg

Wondering if the 4 figures refer to

0000.0000

Calypso

@plumberg said:
Wondering if the 4 figures refer to

Indonesian Rupia I think. 1000 of those are $0.06 worth...

plumberg

@Calypso said:

@plumberg said:
Wondering if the 4 figures refer to

Indonesian Rupia I think. 1000 of those are $0.06 worth...

Money is Money

Just like how water is wet.

HonestOpinions

The communication could have been better. They should have sent the email update sooner.

dev127

@HonestOpinions said:
The communication could have been better. They should have sent the email update sooner.

@HostDZire ?

HostDZire

@dev127 said:

@HonestOpinions said:
The communication could have been better. They should have sent the email update sooner.

@HostDZire ?

Sorry but which email ? regarding incident? we already sent that today.
Now one by one vm is being created and also we are sending activation email to client.

NotFoundException

@HostDZire said:

@dev127 said:

@HonestOpinions said:
The communication could have been better. They should have sent the email update sooner.

@HostDZire ?

Sorry but which email ? regarding incident? we already sent that today.
Now one by one vm is being created and also we are sending activation email to client.

When did you send it, I can’t seem to find anything. I looked at my inbox and spam. My VPS is down too.

AlteredParadox

samsaie

@HostDZire said:

@dev127 said:

@HonestOpinions said:
The communication could have been better. They should have sent the email update sooner.

@HostDZire ?

Sorry but which email ? regarding incident? we already sent that today.
Now one by one vm is being created and also we are sending activation email to client.

The user who registered with an Outlook email has not received any emails yet, and now even your announcement page is inaccessible (the entire WHMCS system is down). What stage has the reconstruction work actually reached?

dedigod

If they were hacked was our VPS data stolen and everything compromised?

Is there a timeline of events? This is a massive issue, much more than a failure

HonestOpinions

@HostDZire said:

@dev127 said:

@HonestOpinions said:
The communication could have been better. They should have sent the email update sooner.

@HostDZire ?

Sorry but which email ? regarding incident? we already sent that today.
Now one by one vm is being created and also we are sending activation email to client.

Vps went down on Aug 4. Email was sent on Aug 7. A lot of people had no way to know, unless they created a ticket or read updates on LET.

vpsTQ

I just want out of my contract, too. That is not how you treat your customers.

dedigod

@HonestOpinions said:

@HostDZire said:

@dev127 said:

@HonestOpinions said:
The communication could have been better. They should have sent the email update sooner.

@HostDZire ?

Sorry but which email ? regarding incident? we already sent that today.
Now one by one vm is being created and also we are sending activation email to client.

Vps went down on Aug 4. Email was sent on Aug 7. A lot of people had no way to know, unless they created a ticket or read updates on LET.

So they were hacked for 3 days with all our data compromised? GDPR requires notification within 72 hours. I never got a notification email and their portal is down. Did they notify you within 72 hours?

wii747

Just wait for the servers. They are working hard as possible to deliver the rebuilt servers. Also the team is not in Europe as they’re an Indian company they are UTC +5:30.

dedigod

@wii747 said:
Just wait for the servers. They are working hard as possible to deliver the rebuilt servers. Also the team is not in Europe as they’re an Indian company they are UTC +5:30.

We've been waiting for days. They were hacked and let all our data get stolen!!!!!!

Who would ever want to use them again?? I want my money back and a full report of what happened

wii747

@dedigod said:

@wii747 said:
Just wait for the servers. They are working hard as possible to deliver the rebuilt servers. Also the team is not in Europe as they’re an Indian company they are UTC +5:30.

We've been waiting for days. They were hacked and let all our data get stolen!!!!!!

Who would ever want to use them again?? I want my money back and a full report of what happened

All important data gets hosted on a big company platform and backups on small companies like this. I always backup to 3 different locations hosted with different companies and data centres.