Hackers wipe live and backup data from email provider VFEmail

Hackers have hit the US email provider VFEmail. They have reported that all live and backup data was deleted. It looks bad their last tweet said “This is all I can do at this time. I will need to get into the datacenter to see if the one file server I caught during formatting can be recovered. If it can, we can restore mail, but most of the infrastructure is lost.”

Oon their website it states that “VFEmail feels it’s important to provide a long-term, stable, environment for our users. In that effort, we perform nightly backups to an offsite host from all on-site and off-site mail storage locations. This backup runs at 12am CST (-0600) and contains all user data.”

VFEmail was setup in 2001 and provides both free and paid for e-mail hosting services.

Updates from VFEmail website :-

!!!ALERT!!!! Update Feb 11 2019
www.vfemail.net and mail.vfemail.net are currently unavailable.
We have suffered catastrophic destruction at the hands of a hacker, last seen as [email protected]
This person has destroyed all data in the US, both primary and backup systems. We are working to recover what data we can.

New updates 2/11/19 6pm CST:

• Incoming mail is now being delivered.
• Webmail is up. Note-mailboxes are created upon new mail delivery. If you cannot login, you may not have received mail.
• Mailboxes are new, no subfolders exist.
• No filters are in place. If you created a filter with Horde, Login to Horde, Create any folders you need.
  Click Filter, Click Script, then click ‘Activate Script’.
• There is no spam scanning at this time.

At this time I am unsure of the status of existing mail for US users. If you have your own email client, DO NOT TRY TO MAKE IT WORK.
If you reconnect your client to your new mailbox, all your local mail will be lost.

At this time, the attacker has formatted all the disks on every server. Every VM is lost. Every file server is lost, every backup server is lost. NL was 100% hosted with a vastly smaller dataset. NL backups by the provideer were intact, and service should be up there.

— VFEmail.net (@VFEmail) 11 February 2019