Rackspace® Hosted Exchange Outage Was Caused By Ransomware Attack

Rackspace® has now confirmed the security incident that led to a massive email outage for its customers across the globe was caused by a ransomware attack on their Hosted Exchange environment.

Source from Rackspace

The Texas-based multi-cloud service provider said in a recent update, “As you know, on Friday, December 2nd, 2023, we became aware of suspicious activity and immediately took proactive measures to isolate the Hosted Exchange environment to contain the incident. We have since determined this suspicious activity was the result of a ransomware incident.”

Rackspace® is currently investigating the ransomware incident with a leading cyber defense firm and its internal security team. The investigation is in the early stages and they don’t know if the customers’ data is affected or if the attackers have access to their sensitive information.

Meanwhile, Rackspace® is actively assisting customers to help them restore their email services by offering them free access to Microsoft 365 E1 license and support in migrating their users to Microsoft 365 until further notice.

However, they haven’t shared any timeline as to when the disruption or issue will be resolved.

The company said, “At this time, we are unable to provide a timeline for the restoration of the Hosted Exchange environment. We are working to provide customers with archives of inboxes where available, to eventually import over to Microsoft 365.”

Restore Email Service After the Rackspace® Hosted Exchange Outage

Rackspace® recommends migrating to Microsoft 365. It’s providing free access to Microsoft 365 licenses and assisting customers to set up a tenant, create user accounts, assign mailboxes and update DNS to restore the email service.

If you have a backup or subscribed to Rackspace®’s Archive Service, you can use the service to search and export critical emails from the Rackspace® servers to PST files. Their Archive Service is unaffected by the incident and is functional.

You can then import this PST to your Office 365 account via the Outlook Import Export wizard or via the Network Upload method to restore the emails.

However, if you didn’t subscribe to the Archive Service and you don’t have a backup, you can use an OST to PST converter tool such as Stellar Converter for OST to extract mail items from the local Outlook cache (.OST files) of users and export the mail items to the users’ Office 365 mailbox directly.  

The software can also save the user mailboxes from local OST files created by Outlook for Hosted Exchange Server email accounts to PST files or export to the on-premises live Exchange Server mailboxes with complete Integrity.

For more details and instructions, refer to our recent blog on migrating mailboxes from local OST files of failed Rackspace® Hosted Exchange Server to Microsoft 365.

Conclusion

The outage which began on December 02, 2023, was initially deemed as a temporary connectivity issue but turned out to be a ransomware attack disrupting the Rackspace® Hosted Exchange infrastructure. If you are a Rackspace® customer affected by the ransomware incident and Rackspace® Hosted Exchange Server outage, we suggest you migrate to Microsoft 365 to restore the email service and use the backup or Archive Service to restore the user mailboxes. If you don’t have a backup or opted for Archive Service before the disaster stroke, use the Stellar Converter for OST Technician. Use the software to scan the local cache (.ost file) of Hosted Exchange Server mailbox created by Outlook and export them to Office 365 users’ mailboxes directly.