For customers in CloudNordic
Unfortunately, during the night of Friday, 18-8-2023 at 04, CloudNordic has been subjected to a ransomware attack in which criminal hackers have shut down all systems. Websites, email systems, customer systems, our customers' websites, etc. Everything. A burglary that has completely paralyzed CloudNordic and also hits our customers hard.
Since we cannot and do not want to meet the financial demands of the criminal hackers for ransom, CloudNordic's IT team and external experts have worked on high pressure to get an overview of the damage and of what it was possible to recreate.
Unfortunately, it has proved impossible to recreate more data, and the majority of our customers have lost all data with us. This applies to all of us who have not contacted at this time.
The hacking attack has been reported to police.
Status
We are deeply concerned about the situation and are aware that the attack is also very critical for many of our customers. In addition to data, we also lost all of our systems and servers and have had difficulty communicating. We have now re-established blank systems, e.g. name servers (without data), web servers (without data) and mail servers (without data).
Get help moving forward without moving
We are ready to
restore customers on the same name servers with a DNS administration interface, as well as new web servers (without data) and mail servers (without data), allowing customers to make mail and web work again without moving the domain. Write to
support@azero.dk with the word GENOPRET in the subject line. In the mail, enter your mail and telephone number as well as the domain, and then you will be given a login to a new website and mail solution, where you can upload your website yourself and create email addresses.
Do it yourself
Regarding domains where you need to be managing DNS quickly:
This is the fastest way to get DNS functional again for your domain.
- We have re-established all name service servers but do not have your DNS zone. Much of the zone can often be copied from https://securitytrails.com/list/keyword > your domain.xx > Subdomains (very technical).
- If you contact us at support@azero.dkand you are verified as the owner as described below (via mail or phone), then you can ask us to be created on our name service again, as the domains still point to. You will then access a Self-service DNS tool (PowerDNS-Admin) hvor du kan gøre en af følgende ting:
- Oprette DNS zonen som du ved den skal være.
- Kopiere zone elementer fra Securitytrails (se ovenstående).
Regarding domains you want to move:
Note that transferring a domain can take days, so if you want to use DNS again faster, you can use the option above first, and then any. move the domain afterwards.
- For .dk domains, you can order a new web hotel from another provider, and you have access to approve the transfer of domain to new provider, via period.dk.
- For .com domains, you also need to order the domain from a new provider, and then use a cloudNordic (auth code) authorization code, here we ask you to contact us support@cloudnordic.comPlease note that we are in a very difficult situation as we cannot keep up with all the queries, so please help us do so quickly and efficiently. We need to verify that we only send auth codes to the domain owner and we can:.
- Send to the mail connected to the registrant (owner) of the domain.
- Call the phone number connected to the registrant (owner) of the domain and verbally tell you what the code is. We can NOT give you auth code by calling us, only by calling out the applicable number. You should therefore contact support@cloudnordic.com and ask us to call you.
- If we cannot contact you by mail or telephone, the process becomes even more time consuming and will end up in the back of the queue of tasks. We will, of course, try to do the job, but at this time we can say nothing about when. We are very sorry about that.
- Contact our .com domain provider directly. It is Ascio and they can be contacted by email help@ascio.com.
- For all other domains, the rules are different. All domains other than .dk, we have with the supplier Ascio, so follow the same procedure as for .com. Some will need to use auth code, others it is not necessary.
Suggestions to be able to recreate your own websites:
Mail suggestions:
- Once you have recovered mail from a provider and you have all your old emails in a mail client (Outlook, Apple mail and the like) on your own computer, you should make sure on your client create a new mail account to the new mail account. Then you can, in your client, transfer emails to the new mail account.
- If you instead correct information in existing account on your mail client, your mail client will delete all mails. After that, you can only get emails back if you first make a restore on your mail client from before the change, and then set up a new mail account, and then move mails over manually. On a Mac you can use the built-in Time Machine program.
What happened?
That is our best assessment, that when servers were to be moved from one data center to another and despite the moving machines being protected by both firewall and antivirus, then some of the machines were infected before the move, with an infection that had not been actively used in the previous data center, and we did not know that there was an infection.
While working to move servers from one data center to another data center, servers that were previously on separate networks were regrettably wired to access our internal network used to manage all of our servers.
Through the internal network, the attackers gained access to very central management systems and the backup systems.
Through the backup system, the attackers managed to access:
- All storage (data)
- Replication backup system
- Secondary backup system
The attackers managed to encrypt all the discs served, as well as on primary and secondary backup systems, whereby all machines went down and we lost access to all data.
No data breach
The attack happened by encrypting all disks for all virtual machines and we have seen no evidence of data breaches. We have not seen the attackers have had access to the machines' content of data themselves, but to management systems from which they could encrypt entire disks. There were very large amounts of data that were encrypted and we have not seen any signs that larger amounts of data have been attempted to be copied out.
We deeply regret the situation and thank you to the many loyal customers who have been with us over the years.
Sincerely
CloudNordic
