Sometimes I’m hard on MXroute. It’s my baby, so I hold it to a high standard, and when it falls short that’s on me. There are other people here doing good work, but the responsibility still stops with me. That’s how I want it. Its shortcomings sit at the front of my mind because those are the things that need my attention. The side effect is that when we do something right, I don’t always stop to mention it. I move on to the next thing that isn’t the way I want it to be.
I’m going to break that cycle for a minute.
Yesterday a customer saw 8 mailboxes compromised as a result of a breach of their internal systems. The malicious third party logged into 8 mailboxes over IMAP, read their mail, came back the next day, and started sending. Over about 80 minutes they sent 3,252 messages to 1,601 remote recipients, aiming to do as much damage as possible to that customer’s reputation with their own contacts.
We had roughly an hour from the first sign of it to having it stopped.
We caught the outbound flood and suspended the account at 14:42 UTC, and then halted 763 messages still sitting in our queue. Those never left our systems. Then we went back through the logs and reconstructed the whole thing: every authentication, every address it came from, every mailbox touched, what went out, what recipients accepted, which ones rejected it, and just as importantly what the attacker never did. No control panel access. No password changes. No forwarders or filters left behind. No reach into their other mailboxes.
All of it went into an 11 page report that we handed to them, so that reconstructing our part of the timeline was one thing they didn’t have to do themselves while everything else was on fire. Then we locked the affected mailboxes so that passwords could be changed safely, and brought the rest of the account back up.
The security practices on their end were not good. I suspect they’d say the same today. We don’t control that. What we control is what happens once it reaches us, how fast we react, and how much of the cleanup we can take off their plate.
Here’s the part I really want to drive home.
That customer bought a $99 lifetime package in 2023. They have not paid us anything since. They will not pay us anything going forward (unless they need an upgrade). Nobody here looked up what they paid before deciding how hard to work.
A lot of companies say their customers are family. It’s usually a line, and I understand why people have learned to roll their eyes at it. But I don’t have a better word for it. Family is who shows up when your world is coming apart, and doesn’t check first what you’re worth to them. We can’t have your back everywhere. But when it’s our systems, our logs, and our responsibility we can. And we do. And we will. Always.