Rackspace says customers will start getting access to ransomware-hit data within days
Eric Killelea, Staff writer
Inside a Rackspace Technology Inc. data center.
SAN ANTONIO — As it entered the third week of an email service outage caused by a ransomware attack, Rackspace Technology Inc. said Friday it will begin restoring customers' access to their data in the next two days.
"We have a very high degree of confidence that the vast majority of customers are going to be able to get their data back," Chief Product Officer Josh Prewitt said in an interview.
The San Antonio cloud computing company's hosted Exchange customers have been without access to their email accounts, contacts and calendars since the Dec. 2 attack.
Prewitt couldn't say how long it would take for all customers to regain access to their data, the loss of which has been a major concern for affected users.
"We'll start with a handful of customers that we will test our process through with and then I expect to scale very, very rapidly in the next week," he said. "I don't expect it to be drawn out for a long period of time."
He declined to disclose how many customers were affected by the attack.
The company shut down its hosted Exchange service after the attack, and Prewitt said it's since been working "to check to see what data is encrypted and or not encrypted."
"We've gone through that process. We now have a really good idea of how much data we have," he said. "We're working the process of extracting it off of those servers [and] putting it into a safe secure environment for customers so that they'll be able to access it."
"We're talking about large amounts of data here and lots of customers," he added.
Rackspace said earlier it had notified the FBI of the data breach and continues to cooperate with the agency's investigation into the attack. The FBI has declined to confirm or deny that it is investigating.
Also Friday, Prewitt said Rackspace continues to work with Austin-based cyber security firm CrowdStrike to conduct an internal forensic investigation of the attack. Earlier, Rackspace said CrowdStrike had determined the breach is isolated to the Exchange server and no other products or customers were affected.
Rackspace is still "going through this investigation very meticulously," Prewitt said.
Earlier in the week, Chief Security Officer Karen O'Reilly-Smith said the company expected to complete its investigation this week. But Prewitt said Friday the company did not have the "internal investigation completed to a state where we can share the outcome of it yet."
When its investigation is complete, he said, Rackspace does "intend to share root cause details, attack vectors, all of that."
"Our goal here is to help make the tech community stronger by sharing what we've learned through this," Prewitt said. "A ransomware attack can happen to anyone, any company of any size. The more we're able to share about our experience and how we've dealt with it, how we identified it and how we handled it, the better off the tech community will be."
Little known so far
So far, though, the company has said little about the nature of the attack or how it's being handled.
On Monday, an outside advisor to Rackspace said the company identified the culprit only as "a criminal, financially motivated group — a known ransomware group." The company has not specifically identified the attackers, disclosed what they were seeking or said whether the company is paying a ransom to retrieve access to data. Also unclear is how the attackers gained access to Rackspace's servers.
Ransomware criminals encrypt a victim's data and demand a ransom payment to return access. There is no promise that a company or group paying a ransom will have access to its data.
Prewitt said earlier this week the company had not determined whether it will exit the hosted Exchange business, which generated about $30 million in annual revenue, or 1 percent of the total annual revenue. He said the company had considered leaving the business in the past year.
On Friday, he said three-quarters of affected customers had the ability to "send and receive mail" through Microsoft 365, but without access to archives and data stored on Rackspace's hosted Exchange servers.
Amid the ongoing investigations, many customers are taking to social media platforms to blast Rackspace's status updates posted to its corporate website and Twitter account. Several also have filed proposed class-action lawsuits over the loss of data, the company's response to it and other issues.
"I would have sympathy with the ransomware situation if they had handled support and messaging appropriately and if I had faith that they were following their own security strategies," Málaga Smith, president of Communications Team, a client brand strategy and account management firm in California, said early Friday.
Friday afternoon, Prewitt said Rackspace continues to have its phone queues "completely swarmed" with employees ready to help affected customers.
"Hundreds of Rackers have volunteered their time to help customers through this process," he said. "Our phone queues and wait time is very low. Typically, there's no wait and we're eager to help customers get back on track."
eric.killelea@express-news.net
Eric Killelea
Reach Eric on
Eric Killelea is a technology reporter, covering Space X and area cybersecurity, cloud-computing and IT companies. Before moving to Texas, he worked for local newspapers and freelanced for The New York Times in Minnesota, New Mexico, North Dakota and Montana. He is from New Jersey.