Rackspace Warns of Phishing Attempts Post Ransomware

See Also: Finding a Password Management Solution for Your Enterprise

Texas-based Rackspace experienced a disruption in its Microsoft email service servers that it at first described as a “security incident” (see: Rackspace Hosted Exchange Still Offline Over Security Issue).

Later, the company said in an update that it now believes the “suspicious activity was the result of a ransomware incident.” The company is currently engaged with cybersecurity firm CrowdStrike to investigate and put remediate measures in place, it said in a Friday update.

“Due to swift action on the Company’s part in disconnecting its network and following its incident response plans, CrowdStrike has confirmed the incident was quickly contained and limited solely to the Hosted Exchange Email business,” the company said.

Rackspace did not disclose any particular ransomware actor and it says, the incident has not affected Rackspace’s other services.

Texas-based Rackspace is among the world’s largest managed cloud providers, counting more than 300,000 customers worldwide, including two-thirds of the world’s 100 largest publicly traded businesses.

In a filing with the Securities and Exchange Commission, the company said the ongoing service disruption will likely to create a financial loss for its Hosted Exchange business, which generated approximately $30 million annually in revenue.

Phishing Attacks

Rackspace warns about scammers and cybercriminals who may take advantage of the current situation by pretending to be the support staff of Rackspace offering help in transitioning to Microsoft 365 and get your email back up and running.

“Emails from Rackspace will only have the domain name @rackspace.com without any special characters or numbers and phone interactions with Rackspace support will not include requests for login credentials, or personal information such as social security number or driver’s license,” the company says.

The company also shared a list of best practices including changing passwords in regular intervals, utilizing different passwords across personal and professional accounts and monitoring banking account statements and credit reports for suspicious activity.

Apart from staying vigilant, the company also recommends:

• Do not open any suspicious email attachments;
• Do not click on any suspicious links;
• Ensure recognize the sender and the email domain. Scammers will often try to mask emails to look legitimate. Be wary of suspicious emails, including those with typos or claims of “urgent request.”
• Do not respond to a message from an individual you do not recognize. Please login to your control panel and create a ticket, including details about the message you received.

Class Action Lawsuit

California-based Cole and Van Note last week announced that it is filing a “class action lawsuit against Rackspace Technology, Inc. for negligence and related violations arising out of the email hosting provider’s recent high-profile data breach.”

“Rackspace offered opaque updates for days, then admitted to a ransomware event without further customer assistance is outrageous,” says Scott Cole, the principal attorney on the case. “Despite hundreds of data breaches every year in this country, I am receiving reports of vulnerabilities in Rackspace’s hosting environment that go back over a year.”

Cole also highlighted that a seeming lack of backup protocols is why a lawsuit like this is critical.

In addition to monetary damages, the suit has also demanded Rackspace Technology implement and maintain sufficient security protocols going forward so as to prevent future attacks.