how it happened
- whoattackergot the AWS console
- the gapone accountproduction and backups together
- the resultcompany closedwithin ~12 hours
what everyone assumed
Keeping backups in the same place as production feels efficient and complete: the data is duplicated, recovery is covered. The assumption is that having copies is the same as being able to recover, regardless of where the copies sit.
what happened
An attacker gained access to the cloud control panel and, when the company resisted an extortion demand, began deleting everything: the production data, and the backups stored in the same account, snapshots and all. The single set of keys that ran the business also erased its only copies.
step by step
- backups live in the same cloud account as productionOne set of keys controls both.the assumption breaks here
- an attacker reaches the control panelAnd demands money.
- the company resists; everything is deletedProduction data, backups and snapshots, through the same console.
- June 2014the company shuts downDestroyed in roughly twelve hours.
how it surfaced
In June 2014 the company was destroyed within roughly twelve hours, unable to recover because its backups had been reachable and deletable through the same console as production. It shut down permanently.
A backup that shares an account, and an admin login, with production is not a separate copy; it is the same target.
Recovery requires isolation, a copy a compromised console cannot delete.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersSomeone takes over the account and demands money. When you refuse, they start deleting.what it costs youWithin hours there is nothing left to restore from, and the business cannot recover.
- or it goes like thisit happenedCDK Global, 2024howYour main software vendor is hit and goes dark for two weeks.what leavessales, orders and invoicingwho ends up with itcompetitors, as customers go elsewhere
- or it goes like thisit happenedMaze / Allied Universal, 2019howAttackers copy the data before they lock it.what leavesfiles your backups cannot take backwho ends up with itthe public, when it is leaked
sources
your turn
what you can do about it
this week
Check that at least one backup copy sits outside the console a stolen admin could reach.
If your backups live in the same tenant as production and a compromised admin account could delete both, you have redundancy without recoverability. Code Spaces is the extreme version of that gap. Whether at least one copy is isolated beyond your own console is the question it asks.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →