...told customers to consider all of their data lost...

And the backups? Or,... we forgot to make any backups because our customers did not want to pay or we never tested a restore procedure or do not believe in backups?

Oh yes, it is "cloud" and all will be well and peachy. Guess it rained, then froze and the sun evaporated both ice, water, cloud and the business(es) in one go.

Why is it the company's responsibility to make backups of the customer's data? It's the customer's responsibility, and any customer who doesn't believe that to be the case deserves everything they get.

Depends what they thought they were buying, really.

It's not unfair to want to offload the work and expertise required to to backups to a 3rd party, in exchange for a fee.

Indeed, almost all cloudy storage outfits make this a selling point.

If CloudNordic provided a back up service then yes, it's on them. But you are not meant to have just one back up for data resilience. In a physical setting you are meant to have an onsite back up, and an off site backup. If you're operating solely in the cloud you should have a back up away from the provider because it's not enough to just rely on the provider's backup.

These days there's a plethora of companies offering cloud to cloud backup services. They are fully automated and tend to be rather cheap (think €2-3 per user per month for email and cloud file storage).

It's still the cloud, but what are the odds of two major cloud providers being affected at the same time?

I guess you could extend it with backups to an on-site server on a monthly or weekly basis.

People just don't realize how vulnerable the cloud can be.

The company is definitely responsible for providing the service they have been contracted for, though. They are clearly not doing it - I don't know what they're supposed to serve, but I doubt wiped servers can serve it. I suspect they are also responsible for storing the customer's data, which they are also not doing.

And the reason they are not providing the service is no (or vulnerable) backups.

The customers' customers , of course, will probably complain about CloudNordic's customers (their own service providers) not having their own backups, and they would also be right, for much the same reasons.

Why is it the company's [CloudNordic's] responsibility to make backups of the customer's data?

If a CloudNordic customer borks their own data, that's on the customer. If CloudNordic borks customer data, that's on the CloudNordic.

This case is the latter, and the onus is on CloudNordic. They fucked up.

[Edit: It's CloudNordic's own data that they failed to adequately protect and by extension, their customers' data.]

According to the article, the criminals managed to also get all the backups. If I understand correctly, there was an insecure server trasfer procedure that resulted in a window during which everything was connected at the same time, and the attackers exploited that. Apparently, there were no offline backups.

The cloud: someone else's computer.

Then they have misunderstood the principle of backup , which is supposed to be immutable !

I am guessing there were before the migration there were carefully separated backup and/or archive systems but unfortunately the front door was left open to Mr Cock-Up...

Technically I imagine you might hold that the data and backups were still there (just add decryption key) although about as useful as dehydrated water.

Some good will have come from this cock-up if those, who ought to have known better, now understand the backup you don't directly control and can test, and do test, is no backup at all.

I don't think this article included all information, and the backup part is certainly important.

While I have no experience of clouds I must admit i have assumed a cloud provider always have backups.

It''s not just about backups because of hardware faults, fat-fingers, etc. In the case where you are using any cloud services, that provider could stop working at any second, without warning, for no apparent reason!

This case is one way that could happen but there are many others. The most likely, in my opinion, is a commercial issue: the company collapses, without warning to any customers, and ceases trading instantly. All data instantly inacessible - including any backups they hold.

For that reason, it is essential that if you use a cloud service, you have a disaster recovery plan which handles the cloud provider effectively disappearing into a wisp without warning.

Most importantly, if you contract with company A to run a service for you, make sure that you contract with a different company for the DR backups.

Read the article.

It states clearly that backups were encrypted with ransomware.

"This gave the intruders access to both the central administrative systems, storage, replication backup system and secondary backups, all of which they promptly encrypted for extortion."

So they had multiple backup systems, but all of them were online???

This is sadly common. It makes backups easier and faster. It makes restoring from backup easier and faster.

It also means that your backups offer no protection against ransomware or a hacker.

It appears that yes, all of them were online or at least all networked with internal systems during the move because no one could apparently forsee that could cause problems.

Hey, CloudNordic, if I was one of your customers I wouldn't be worrying about getting my site back online with your help.

I'd be getting it back online with the help of a different provider.

You screw up in that magnitude, I vote with my wallet.

Do you seriously believe other providers are immune, by means of magic ?

Just a few days ago one of the megaCloud providers had their "master key" stolen, which meant ALL servers could be read and changed.

A few years ago a smaller, but non-trivial cloud provider had their "management console" hacked and essentially ALL servers in the open.

The entire "cloud" idea looks questionable.

Cloud services are increasingly commoditized and compete on price. Offline backups involving LTO tape libraries or hard drives will be one of the first things the bean counters will cut.

The entire "cloud" idea looks questionable.

While I fully agree that the cloud is not the place for business critical systems and data, and sensitive data, this is not a case of "magic". CloudNordic failed in basic security principals by their own admission:

During the work of moving servers from one data center to the other, servers that were previously on separate networks were unfortunately wired to access our internal network that is used to manage all of our servers.

Unfortunately? Try negligently. They put all of their eggs in one chicken coop, and the fox was already in residence. Granted, it's early days so things might change, but it's unlikely that a company would make such a statement on a whim.

" Some of the machines were apparently infected before the move, and during the transfer servers that had been on separate networks were all connected to CloudNordic's internal network. "

Quite apart from the $64k question -- why the infected machines were not detected before or during the move, did anyone consider network security at all or was the 'internal network' effectively a giant hub? And if the machines were originally segregated (presumably for good reason), why was this not maintained?

Ouch, surely this must count as a very expensive lesson for both customer and service provider...

We do use online backups (quicker backups and restores) but we do store our data on offline media as well, but financial data is also stored online, offline and in the cloud.

Gone are the days when a simple backup to tape was good enough.