When thousands of office email servers were broken into at once

The story

Microsoft Exchange Server is email server software that organizations can run on their own hardware. In January 2021, attackers started using four flaws in it that were not yet publicly known.

The flaws let attackers read email, take control of the server and reach other computers on the same network. Many attackers left behind a backdoor, a small hidden file that let them return later.

Microsoft released updates on March 2, 2021. By then, many other groups had joined in, scanning the internet for servers that had not been updated. By early March, an estimated 250,000 servers had been hit worldwide, including around 30,000 organizations in the United States. Small and medium businesses and local governments were among the main victims. Ransomware followed within days.

Why it mattered

It showed how small businesses and local governments that run their own email servers can be swept up in an attack aimed at everyone at once. Once a fix was public, attackers raced to reach unpatched servers before their owners did, and the back doors they left behind meant installing the fix alone was not enough.

The lesson today

Updating the servers closed the flaws, but it did not remove backdoors already planted. Organizations had to check whether they had been broken into as well as whether they were patched. Running your own email server means taking on all of that work. Many businesses now let a cloud email service handle it, with someone checking the settings.