<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=UTF-8"/>
</head>
<body>
<div><div class="markdown">
<p dir="auto">Information that should be shared:<br/>
From Jenna Jonteaux-McClay, A Runbox and Posteo user and Mailmate of course!</p>
<p dir="auto">On Friday evening Runbox, along with at least two other email services, started experiencing Distributed Denial of Service (DDoS) attacks by extortionists who are demanding that we pay them a ransom to prevent further attacks.</p>
<p dir="auto">The attacks consisted of a massive volume of data traffic against our services that overwhelmed our servers and intermittently blocked our customers from accessing their email.</p>
<p dir="auto">This message contains important information about these attacks, what Runbox is doing to mitigate the situation, and what you as our customer can do if you experience any disruptions.</p>
<p dir="auto">For our most recent updates regarding this incident, please see our Service Status page at <a href="http://status.runbox.com">http://status.runbox.com</a>.</p>
<h1>How might this attack affect me?</h1>
<p dir="auto">The extortion letter we have received from the attackers included threats about more severe DDoS attacks on Monday if Runbox does not pay the ransom.</p>
<p dir="auto">Paying criminals money that you as a customer have originally paid us for the services we provide is unacceptable, and would only fund further attacks in the future.</p>
<p dir="auto">If Runbox is subject to another DDoS attack you may experience problems connecting to our website and email services, and there<br/>
might be delays delivering incoming and outgoing email. Our web hosting services may also become inaccessible.</p>
<p dir="auto">The attacks will not affect any of the data stored on the Runbox servers. Your email is securely stored and is safe from these types of<br/>
attacks.</p>
<p dir="auto">You can find more information about the nature of DDoS attacks further down in this message.</p>
<h1>What is Runbox doing about this?</h1>
<p dir="auto">Since the attacks started we have worked around the clock with our system administrators and Internet Service Provider to mitigate them, and are implementing additional measures in preparation for possible further attacks on Monday.</p>
<p dir="auto">Although we cannot reveal details of these measures at this time we can assure you that we are doing everything in our power to ensure that our services remain accessible to all our customers. The measures we are deploying will also strengthen our defenses in the event of future attacks by other groups.</p>
<p dir="auto">We should be clear that DDoS attacks are a criminal act, and that demanding a ransom to prevent them is extortion. Runbox has persevered against similar DDoS attacks in the past and never in our history paid criminals who attack our services. And we are not going to start now.</p>
<p dir="auto">In fact, anyone who does comply with such blackmailing to prevent DDoS attacks helps create a market for these criminal groups.</p>
<p dir="auto">Instead we will report this incident to The Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime, and will cooperate with the Norwegian Computer Emergency Response Team (NorCERT) to mitigate against further attacks.</p>
<p dir="auto">We have also learned that Runbox is not alone in being attacked, as The Record reports that Fastmail and Posteo are also under attack by the same extortionists: <a href="https://therecord.media/ddos-attacks-hit-multiple-email-providers/">https://therecord.media/ddos-attacks-hit-multiple-email-providers/</a></p>
<p dir="auto">We are now coordinating our fight against these criminals and will cooperate with relevant law enforcement in our respective countries.</p>
<h1>Why not just pay the ransom?</h1>
<p dir="auto">Paying extortionists would provide no guarantee that further attacks will be prevented, and could instead make the victim more attractive for similar attacks.</p>
<p dir="auto">Furthermore, funding such criminal activities would only increase the likelihood of further attacks by the same criminals or other malefactors.</p>
<p dir="auto">Anyone who is experiencing DDoS attacks is encouraged to never capitulate, as it only makes the market for these criminal activities grow stronger.</p>
<h1>What can I do?</h1>
<p dir="auto">Runbox, together with our partners, will do everything we can to continue fighting these attacks, and our goal is to prevent any further disruptions to our services.</p>
<p dir="auto">If you experience disruptions in our services, please try again in a short while. If our webmail doesn't respond you may also set up an email client which may respond in the meantime, as described here: <a href="https://help.runbox.com/imap/">https://help.runbox.com/imap/</a></p>
<p dir="auto">Do not be concerned that there are any technical issues with the Runbox servers themselves. Once you are able to access our services again, any queued email will be delivered to your account and no data will be lost.</p>
<p dir="auto">You can at any time access our Service Status page at <a href="http://status.runbox.com">http://status.runbox.com</a> and find our updates regarding this incident. You may also inform any sub-accounts by forwarding this message to them.</p>
<p dir="auto">We refuse to give criminals the power to decide which Internet services you use, and we ask that you continue supporting Runbox and other independent services who refuse to be defeated by extortionists.</p>
<h1>What is a DDoS Attack?</h1>
<p dir="auto">A DDoS attack prevents users from accessing a service by using a large number of computers to send a very large amount of requests to the targeted service.</p>
<p dir="auto">This floods the bandwidth and resources of the system to a point where genuine connections from users cannot get through. This makes the service appear to be down.</p>
<p dir="auto">DDoS attacks can exceed bandwidths of 1 Tbps, and involve a large network of Internet-connected devices that have been hjacked by criminals. These individuals or groups then direct the computers to send large amounts of data traffic to their target, or sell their services to others who execute DDoS attacks.</p>
<p dir="auto">Such attacks can take place against any Internet service including email services like Runbox, and often include demands to pay a ransom for the attacks to stop.</p>
<h1>If Runbox is attacked how can I get information?</h1>
<p dir="auto">In the event Runbox appears to be unavailable we will use the following websites for status updates and points of contact:</p>
<ul>
<li>Our status page at <a href="http://status.runbox.com">http://status.runbox.com</a></li>
<li>Our Twitter page at <a href="https://twitter.com/Runbox">https://twitter.com/Runbox</a></li>
<li>Our Support Center at <a href="https://support.runbox.com">https://support.runbox.com</a></li>
</ul>
<p dir="auto">We appreciate that this message might be confusing or alarming, and that you may have questions that are not answered by the above.</p>
<p dir="auto">You may then reply to this email, but keep in mind that we will be receiving numerous requests and our main concern is to ensure that our services remain accessible.</p>
<p dir="auto">Know that we are already working with experts on mitigation and prevention of such attacks, and that our services will soon normalize.</p>
<p dir="auto">Best regards,</p>
<p dir="auto">The Runbox Team</p>
</div></div>
</body></html>