City Hall email hit by ransomware attack on exchange host Rackspace

MUNCIE, Ind. − A December ransomware attack at a major cloud computing company, Rackspace Technologies, based in Texas, disrupted email service to at least thousands of its business customers and tens of thousands of email users, including some at Muncie City Hall.

Rackspace hosts email exchange services for the city. The attack on Friday, Dec. 2, involved about 40 users at the city, primarily managers. Initially it shut down the email function, according to Adam Williams, IT administrator for the city.

More:Accutech faces twin class-action lawsuits after data breach bares personal info of 39,000+

He said the ability to send and receive emails at City Hall was restored within a few days, with the help of C.S. Kern, a local print and web design company that assists the city with IT needs.

Mayor Dan Ridenour said his email was working again by the following Wednesday, but the city continues to suffer a loss of the planning function of the Microsoft email exchange hosted by Rackspace.

"I'm having to stay later," the mayor said. "You can't do as much remotely."

Rather than pushing a button and having an appointment immediately flow to a central planner, managers are having to use other means to plan their days.

Williams said that Rackspace has not said when those planning functions might return, and it is currently working to restore email message archives lost in the attack. C.S. Kern is working directly with Rackspace on behalf of the city on issues related to the loss of service.

Williams said about 10 percent of the city's employees were on the exchange email and affected.

More:Muncie Mayor Ridenour announces re-election run in 2023

Days after the email failure, Rackspace told customers it had been the victim of a ransomware attack. The company has declined to say if a ransom was paid. It has also failed to provide the number of customers affected, although three days after the attack it advised that its support team had aided thousands of its business customers and tens of thousands of users.

Rackspace has been urging most customers to convert to the Microsoft 365 cloud based platform but Williams said the city has been able to make email addresses from before the attack to work for people emailing to the city. Affected city officials have been able to reply with a temporary email addresses.

Williams said that emails sent during December have been archived and available. Emails stored from the more distance past, no longer kept on the individual personal computers, have not yet been entirely restored.

"Due to the swift action to disconnect our network – and because of the way that the Hosted Exchange Email environment was designed and segmented – the incident was quickly contained and limited solely to the Hosted Exchange email environment," said Rackspace CEO Amar Maletira in a statement posted to the company's website. "No other Rackspace products, platforms, solutions, or businesses were affected or are experiencing downtime due to this incident."

In a Securities and Exchange Commission filing four days after the attack, Rackspace said in event "may result in a loss of revenue" for its $30 million exchange hosting business.

At least one class action lawsuit has already been filed against Rackspace in California as a result of the ransomware incident.

Ransomware usually involves the criminal placement of malicious software in a computer system that stops its functionality, sometimes exposing its data to breaches. The hacker then requests a ransom in exchange for providing a means to returning the system's functionality. It has been a growing problem in the United States. According to CheckPoint Research, one in 40 organizations is targeted by a ransomware attack weekly.

Williams said the city workers have to be extra cautious now because some hackers are known to be sending phishing emails to victims of the Rackspace email meltdown, pretending to be notifying them of a solution. Once a phishing email is opened, it can infect the system with malware.

"They know people would be anxious to click on something like that," he said.

Ridenour said City Hall is still functioning and workers are all doing their jobs.

The loss of the email planning function did "really stress out" some user at City Hall, Williams said. But he added that some others almost seemed gratified for the opportunity to return to paper.

This article originally appeared on Muncie Star Press: City Hall email hit by ransomware attack on exchange host Rackspace