Cyber Incident Victim: Exabytes
Date:
Sep 2021
Location:
Malaysia
Summary
A ransomware attack disrupted services at Exabytes, a web hosting provider serving over 160,000 global clients. The incident impacted WordPress hosting, virtual private servers, and Windows-based shared hosting, with data restoration progressing slowly—only 3% of affected systems were recovered initially. Attackers demanded $900,000 in cryptocurrency via a since-deleted social media post, though payment status remains unconfirmed. The company detected the intrusion and notified authorities, but full recovery timelines were unspecified during the early restoration phase.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Exabytes, a Penang-based provider of domain and web hosting services with over 160,000 global clients, detected a ransomware attack at 5:00 AM on September 17, 2021. The company publicly disclosed the incident through a notice posted on its support website’s Community Forums at 9:12 PM that evening. The attack disrupted multiple critical services, including WordPress hosting, virtual private servers, and Windows-based shared hosting platforms. By 12:30 AM on September 18, Exabytes reported that only 3% of affected data had been restored, indicating a protracted recovery process with no estimated timeline for full service restoration. The company’s support portal acknowledged ongoing operational challenges but did not specify technical details about the ransomware variant or intrusion vectors.
Exabytes confirmed it had notified relevant authorities about the attack but provided minimal public details regarding containment measures or forensic investigations. Attackers claimed responsibility through a since-deleted social media post demanding a $900,000 ransom (approximately RM3.75 million) payable in cryptocurrency, though Exabytes never publicly confirmed payment or negotiation status. The incident caused sustained service interruptions affecting an unspecified subset of customers across the compromised hosting environments. No customer data breaches or exfiltration attempts were mentioned in available communications. Restoration efforts proceeded incrementally, with the company prioritizing system recovery while maintaining limited public updates through its support channels during the immediate aftermath.