Did you remember ot backup today? if not then you are likely not alone, but you REALLY should.. like REALLY REALLY REALLY should..
A Danish booking service for hotels was recently hit by ransomware, they took the unusual approach and live blogged about the attack – it is scary reading, and it leads back to – did you remember to backup today?
Link to liveblog
As their blog likely will dissapear in time, below is a copy of the story so far..
| Operational messages | |
| 16-06-2021 07:29 | Update this morning! We are still re-installing the servers. We still continue to transfer the hotel data. |
| 15-06-2021 18:13 | Tonight team 1 will continue re-installing the servers. We have installed 29 servers today. Team 2 will be installing a cluster with hotel files. We will NOT go live tonight and I doubt about tomorrow. Hopefully we will go live this Thursday. |
| 15-06-2021 14:00 | NO: Det er stadig utfordringer for brukerne og sende mail fra Picasso. Teknikere jobber med det. |
| 15-06-2021 13:46 | We have now 5 teams working. Two teams are re-installing new servers and one team is transferring data from IBAS discs to Techotel SAN disc. This process will take time. We will publish a new update later. |
| 15-06-2021 12:31 | Berlingske had this Sunday two pages, about the ransomeware attack which has hit us. Today in Berlingske Business section on page. 11, they have written a page about ransomware attacks, in which they explain our situation and others. |
| 15-06-2021 12:26 | Update! We have received the hotel data from IBAS. We have an Eagle Shark consultant to advise us, on how we can restore 28 Terabyte ASAP – as soon as we get the new clean servers running. |
| 15-06-2021 11:23 | Support Yield Planet PL: support@yieldplanet.com. Phone: +48 22 769 38 09. YP Support in DK: 3619 2131 ( Bettina ) |
| 15-06-2021 11:07 | Update! We have just been in contact with Yield Planet. Yield Planet Polen has informed us, that they can still see reservations by mail to your hotel – you thereby don’t need to close your YP allotment. Furthermore, YP reduces your allotment when you receive new reservations. So, you might be able to get your availability from YP + by using excel. We will shortly publish an email and support number to YP Poland. You are also welcome to contact Bettina from YP DK support. |
| 15-06-2021 10:05 | Second update! Last night we re-installed the SQL1 cluster for Sweden, and SQL2 cluster for Denmark and Ireland. We still needs to re-install the hotels .exe and user files. |
| 15-06-2021 08:59 | Update! IBAS hotel data / reservations and the NAS boxes should be in DHL Denmark’s custody by now. We expect the data to arrive today, very soon. Please be calm, we need to reinstall the whole hosting. We will come with a new update soon. |
| 15-06-2021 08:55 | We have installed 3 new Domain Controllers last night. However, we need to re-install all of our servers to be sure, that we don’t have any hidden virus files. |
| 15-06-2021 06:18 | We went to sleep at 03.00 – 06.00. We need to get some sleep for some hours. I expect we will have a new update at 09.00-10.00. |
| 14-06-2021 15:20 | We don’t have any real news! However, we are now formatting and re-installing all of our RDS servers and tonight we will further re-install our new hybrid clusters which is 4 month old. This is all being done, to be 100% sure that we don’t have any hidden ransomware virus anywhere. |
| 14-06-2021 12:45 | Further update, we have just been in contact with one of our customers – who asked us how long time it will take before Picasso were running again. Now that we have got all the information regarding the data that can be recovered. We told our customer, that we expect to be live again this week, but we don’t know for sure which day yet. |
| 14-06-2021 12:17 | IMPORTANT INFO FOR DK, SE, IE! After Techotels filling of the information to the Danish Data Protection Agency, it has been agreed with the agency that no individual hotel – Data Controller (Dataansvarlig) should make any fillings themselves to the Danish Data Protection Agency. Techotel have informed the agency and provided them with all the information needed concerning all the hotels. This covers ALL hotels in Denmark, Sweden and Ireland. |
| 14-06-2021 10:02 | More information regarding the latest update. Now we will be focusing on re-installing many of the servers to make sure that we doesn’t have any virus. We will also be cleaning other servers. I don’t think any of the hotels will go live today. |
| 14-06-2021 09:58 | Here is the latest update for DK, SE and IE. IBAS has confirmed that we will get a 100% recovery of all our data. IBAS has also confirmed that the hotel data is readable and NOT encrypted. The data will be flown to Denmark tonight. |
| 13-06-2021 20:23 | We have some good news, IBAS have informed us that they can read the files from the backup and the files is not encrypted, at 3 of the backup files which were found by NAS. This means, that we can complete the backup from IBAS. I will be calling IBAS again tonight. |
| 13-06-2021 19:04 | Regarding GDPR, you are welcome to receive a copy of the information that has been sent to the Danish Data Protection Agency. Just write a mail to techotel.hdw@gmail.com and then we will get back to you đ |
| 13-06-2021 18:45 | The Eagle Shark team is still working on decrypting the files. We haven’t heard form IBAS yet, but the last information we got from them were positive. Since, they can read the data from the backup drives. |
| 13-06-2021 17:37 | Regarding GDPR, last night we filled out the breach information with the Danish Data Protection Agency. We have informed that the breach information includes customers in Denmark, Sweden and Ireland. The National Data Protection Agencies in Sweden and Ireland has received information about the filing in Denmark. We have filed it out, as Data Processor without identifying the Data Controllers in the relevant questions. Please note that you may have your own obligations as Data Controller. |
| 13-06-2021 15:31 | DK: We have not heard from Eagle team yet. IBAS har informed us that it look positive, that they can fix the backup drives. But they need more time to be sure. We will write again af 18.30. Your hotel will not get live today. |
| 13-06-2021 13:34 | Sorry but Eagle team still we are working at decryption hotel files. IBAS has let am message contact the now. I dont think we will go live today. We han 14 skilled technical persons working at th project. |
| 13-06-2021 10:54 | Not much to say Eagle team stil work with decrypting. IBAS has as expected not answered yet. I will come in 2 hours |
| 13-06-2021 06:51 | Morning. Technicals worked late and are sleeping until 08-08.30. Today Eagle team will continue focus to get hoteldate decrypted, with the new keys. We will inform when we succeed, IBAS NO team will report status of repairing the damaged backup later today. |
| 12-06-2021 21:20 | Last update until DK Time 06.30. Team1 will be finished scanned the most of the servers for keys at DK time 02.00. We have got more keys to unencrypt. We hope to get the keys for the hoteldata. This will tage the hole night. |
| 12-06-2021 20:11 | Techotel Sweden: Hej alla, som vÄra kollegor i Danmark informerar om fortsÀtter vÄrt arbete med att se till att fÄ systemen upp att köra sÄ fort som möjligt. VÀnligen fortsÀtt följa oss hÀr pÄ driftinfo! |
| 12-06-2021 18:38 | It is going forward for both teams. Team 1 are scanning all the 250 servers for virus and keys. Team 2, which focus is the IBAS data recovery, are trying to fix the hotels backup. However, the systems will not be ready tonight. I will give you all more information later during this evening, but we need more concrete results, before we know when we will go live. |
| 12-06-2021 16:58 | Update from the Eagle Shark team. The scanning is running better now. Next Update 19.00. |
| 12-06-2021 15:51 | Update from the Eagle Shark team. They are not finished scanning the servers after keys. There is an issue with user rights. Next Update 18.30. |
| 12-06-2021 15:15 | Info from IBAS: Nu har jeg fÄet fÞrste status fra ingeniÞrerne, og nogen af diskene skal blive fÊrdige med udkopiering af rÄdata i lÞbet af i aften, mens nogen er fÊrdige i morgen eftermiddag. Men det betyder i hvert fald, at vi sÄ smÄt kan begynde at komme med mere brugbar info i lÞbet af morgendagen. |
| 12-06-2021 13:22 | I Just talked with the Eagle team and they are not finished with scanning the servers. I will come with a later update at 15.30. NB! the system will not go live today, when we get the right codes, It will take many hours to uncrypt the files. |
| 12-06-2021 13:02 | IBAS just gave us an early update about the recovery. I got the news that we can use most of it. |
| 12-06-2021 12:33 | I just got new information from IBAS data recovery. I need to login and read more about it. Sorry, we thereby delay the update to 13.00 DK Time |
| 12-06-2021 09:44 | Explanation to the two lines below. We follow two traces to get the data, but only one of the traces need to succeed to get access to the hotel data. I will make an update around 12.30 or if I get news. |
| 12-06-2021 09:40 | A morning status: Eagle Shark Team has found one more key last night, which will be tested soon. We will the next hours scan all 250 servers to find all keys. Thereafter, we need to test if the keys we found can be used to uncrypt the hotel data. |
| 12-06-2021 09:32 | We will contact IBAS Norway at DK time 09.15 to get a status of the project with recovering the damaged data. We hope to give you more information at 09:45 DK time. |
| 12-06-2021 06:15 | The E H developer have been up working the most of the night. At DK time 09:30 we will contact the developer for more information, on how far they are with finding more keys. |
| 12-06-2021 06:10 | This afternoon the backup NAS discs were flown to Oslo, to IBAS the world best company to read damaged data. IBAS will work at the NAS discs this whole weekend. It was not a good evening. |
| 11-06-2021 22:44 | The bandits gave us keys to uncrypt the files, but the keys does not always function, so we don’t have access to the hotel data yet. To night an Eagle Shark consultant writes a program to scan all 259 servers for more keys. |
| 11-06-2021 22:34 | The bandits gave us keys to unencrypt the files, But the keys does not function always, so we dont have access to the hoteldata yet. This night an Eagle Shark consultant writes a program to scan all 259 server for mere keys. |
| 11-06-2021 14:54 | The interesting question is when will your hotel system go live again. The Bandits are actually helping us with cleaning the system. We think that the chances to go live tonight is smaller, than going live this Saturday. We will work the whole weekend until your system is running again đ |
| 11-06-2021 14:46 | Update: It is very difficult, Team 1 are writing scripts to find the files to uncrypt. Team 2 are working with uncrypting the SQL hotel data. Team 3 are uncrypting mail servers. Team 4 are sending the backup Nas to NO to be recovered. IBAS are working this weekend. |
| 11-06-2021 12:30 | A reminder. Mailadresses from and to domains techotel.se and techotel.dk are NOT in use. Please use other contactmethods. But please follow this page for further information. |
| 11-06-2021 11:14 | NO: Dette pÄvirker ikke bruk av Picasso for vÄre kunder pÄ norsk hosting, eller kunder med egne servere, men Picasso Online og Yield Planet er fremdeles nede. Dere kan legge inn eventuelle bookinger fra Channel Manager manuelt selv, husk da Ä legge til alt.res nummeret |
| 11-06-2021 10:43 | This is technical info: The encryption of some of the files have been conducted over maybe 4 times. This is very complex to uncrypt. Team 1 are in contact with the bandits, to get the right codes. Team 2 are trying to involve other specialist. |
| 11-06-2021 06:17 | Team 2 just finished the extra backup of all hotel reservations. They go to sleep now. Team 1 cannot be sure when, but we focus to get the hotels reservations decrypted. More to come. |
| 11-06-2021 04:00 | We need to sleep now. We are not live, but will continue Friday at 10.30. |
| 10-06-2021 22:51 | We have now got the decryption keys and are working on decrypting them in this moment. We are working in two teams. It is difficult to inform when we will be live. I dont think we will be live within the next 7 hours. |
| 10-06-2021 19:52 | Just now we got the final code til clean til cryptatet files. We will continue the hole night |
| 10-06-2021 18:28 | We got some tools to decrypt the hotel files with. We have meeting at 19.30 to come |
| 10-06-2021 16:34 | We have got the bitcoins and are now transferring them to the bandits. We expect that the bandits soon will decrypt the files. |
| 10-06-2021 15:46 | We have signed an agreement regarding the bitcoins for 30 minutes ago and we expect that the bitcoins will be transferred to the bandits very soon. |
| 10-06-2021 14:12 | If everything goes as planned, we will have the bitcoins within an hour and be able to pay the bandits directly and further be able to start the system again. |
| 10-06-2021 12:51 | We and Eagleshark continue the discussion with the bank and other consultants, of how to get the bitcoins and thereby to get our data released. More to come later. |
| 10-06-2021 11:38 | We and Eagleshark will continue the meetings with the bank and we are now closer to find a final solution. However, is is not a financial issue, it concerns the complications regarding money laundering regulations. |
| 10-06-2021 10:20 | We and Eagleshark are still working on getting the necessary Bitcoins, we have been in meetings with the bank to get the transfer done in 2 hours now…… |
| 10-06-2021 06:27 | Status this morning: We and Eagelshark.com were informed about the amount we have to pay, it is much more than we expected! We have pay in Bitcoins to get access to the data. It is large sum that we need to transfer. I will update when we know more and how long it will take to complete the transfer and restore Picasso today |
| 09-06-2021 17:08 | You can read more about the Crypto attack on us and other companies tonight on TV. Read on regarding yours and ours current situation. We expect the hotels to open Thursday noon or evening! |
| 09-06-2021 16:51 | Dear all, we Techotel group expect that tonight at DK/SE time 21.00(20:00 Irish time) to be contacted by an Eagleshark negotiator informing us the amount, we are going to settle for recovering us from the attack. But the bandits do not accept bank transfer so we need to change the amount to Bitcoin. This will take us 3-7 hours. The bandits will then send us a program to decrypt the files. To fix the situation it might take 5- 10 hours |
| 09-06-2021 13:57 | I don’t think we will be live in the next 2-4 hours. Please check your email at the hotel. Picasso is sending an arrival list to your email the evening before |
| 09-06-2021 13:29 | The specialist from https://www.eagleshark.dk/, we are using, is the best at this work. The attacker has not responded. Technical staff for us are cleaning server from virus |
| 09-06-2021 11:35 | Technicians are still working. |
| 09-06-2021 09:51 | Hi Nothing New just now. The specialist are now isolating the servers, that are not attacked from the serves that are under attack. I cannot say if we are live today, yet. People producing virus should be in jail!! |
| 09-06-2021 07:56 | NB: Techotels mail also are attacked and cannot be used. Please follow the update at the homepage |
| 09-06-2021 07:50 | We are hit by ransomware. You have to be prepared to not have access to your date the next hours. Before we get opened access to files again. NB this is not an Techotel error. |
| 09-06-2021 06:59 | In your main mail setup in Picasso if so, you should have an arrival for today, maybe before downtime/attack. Check the booking mail. Else check your digital report. I will write back at 08.00. |
| 09-06-2021 06:52 | We have been atacked by virus. Nothing is wrong with our cloud. We will work together with antivirus specialist to solve this. |
| 09-06-2021 06:01 | Sorry for delay and disturbance. Our Domain Controller the effect several functions. We will inform you futher, we will try to update info approx. 06.40 |
| 09-06-2021 03:53 | We have problems with Danish, Swedish and Irish Picasso . Our technical staff is looking at the issue. We will update information later. |