<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
<title>Dediserve - Status Updates</title>
<description>Dediserve - Status Updates</description>
<link>https://manage.dediserve.com/?cmd=status&amp;action=rss</link>
<atom:link href="https://manage.dediserve.com/?cmd=status&amp;action=rss" rel="self" type="application/rss+xml" />
<item>
<title>{"english":"Formal notice: closure of Dediserve's Jakarta and Singapore sites","portuguese-br":"","german":"","arabic":"","farsi":"","french":"","danish":"","dutch":"","polish":"","spanish":"","swedish":"","turkish":"","portuguese-pt":"","chinese":"","japanese":""}</title>
<link>status/128/--english---formal-notice--closure-of-dediserve-s-jakarta-and-singapore-sites---portuguese-br------german------arabic------farsi------french------danish------dutch------polish------spanish------swedish------turkish------portuguese-pt------chinese------japanese-----/</link>
<guid>status/128/--english---formal-notice--closure-of-dediserve-s-jakarta-and-singapore-sites---portuguese-br------german------arabic------farsi------french------danish------dutch------polish------spanish------swedish------turkish------portuguese-pt------chinese------japanese-----/</guid>
<pubDate>Fri, 30 Oct 2026 00:00:00 +0000</pubDate>
<description><![CDATA[{"english":"Dear Customer,\r\n\r\nThank you for choosing Dediserve. We're writing to tell you about an important change to our services in Jakarta and Singapore, effectively APAC in general.\r\n\r\nWe have continued to review our strategy and, with regret, have decided to cease services at our Jakarta and Singapore sites due to cost pressures in the region. Please accept this email as our formal notice of the closure of both sites.\r\n\r\nWe appreciate this means change for you, and we want to make your move as straightforward as possible. Below you'll find the key dates, the credits we'll apply to your account, and the steps we'd ask you to take.\r\n\r\nKEY DATES\r\nYour services will continue to run as normal until they are switched off.\r\n\r\n- 20 January 2027: Services at both sites are switched off.\r\n- 21 January 2027 onwards: All servers and data at both sites are permanently erased and cannot be recovered.\r\n- 31 January 2027: We fully exit both sites.\r\n\r\nCREDITS\r\n- You'll receive a credit equal to one month of your service charges at these sites, to help with the cost of your move.\r\n- If you purchased a fixed term and have paid in advance beyond 20 January 2027, you'll also receive a pro-rata credit for the period between 20 January 2027 and the end of your prepayment.\r\n\r\nMOVING YOUR SERVICES\r\nIf you'd like to stay with Dediserve, please purchase services at the site you'd like to move to, then create a support ticket. Our team will work with you to plan and support your move.\r\n\r\nWhichever route you choose, please make sure that before 20 January 2027 you:\r\n\r\n- Complete your move.\r\n- Back up any data you want to keep.\r\n- Update DNS records and anything that relies on your Jakarta or Singapore IP addresses.\r\n\r\nSUPPORT\r\nWe'll send you reminders in December and January. If you have any questions in the meantime, please create a support ticket and our team will be happy to help.\r\n\r\nThank you for your custom and for the trust you've placed in Dediserve. We've valued supporting you in Jakarta and Singapore, and we'll do all we can to help you through this change.\r\n\r\nKind regards,\r\nThe Dediserve team","portuguese-br":"","german":"","arabic":"","farsi":"","french":"","danish":"","dutch":"","polish":"","spanish":"","swedish":"","turkish":"","portuguese-pt":"","chinese":"","japanese":""}]]></description>
</item>
<item>
<title>{"english":"RCA - FRA1 Cyber Incident","portuguese-br":"","german":"","arabic":"","farsi":"","french":"","danish":"","dutch":"","polish":"","spanish":"","swedish":"","turkish":"","portuguese-pt":"","chinese":"","japanese":""}</title>
<link>status/127/--english---rca---fra1-cyber-incident---portuguese-br------german------arabic------farsi------french------danish------dutch------polish------spanish------swedish------turkish------portuguese-pt------chinese------japanese-----/</link>
<guid>status/127/--english---rca---fra1-cyber-incident---portuguese-br------german------arabic------farsi------french------danish------dutch------polish------spanish------swedish------turkish------portuguese-pt------chinese------japanese-----/</guid>
<pubDate>Fri, 02 Oct 2026 00:00:00 +0100</pubDate>
<description><![CDATA[{"english":"Root cause analysis: Dediserve Frankfurt (FRA1) incident\r\n========================================================\r\nReference DDS-2026-09-28 | Issued 2 October 2026\r\nDediserve, part of the iomart Group\r\n\r\nSummary: what happened, in brief\r\n--------------------------------\r\n\r\nOn 27 and 28 September 2026, an unauthorised party gained access to the\r\nmanagement system of our Frankfurt (FRA1) cloud platform and deleted all\r\n46 virtual machines hosted there, together with the platform's local\r\nsnapshots of them (shown as backups in the control panel). We contained\r\nthe incident and investigated it with our central security teams. We\r\nreported it directly to Police Scotland and to the national cyber\r\nsecurity authorities in the UK and Ireland, and Police Scotland informed\r\nAn Garda S\u00edoch\u00e1na on our behalf. This document explains what happened,\r\nwhat it means for you and what we have done.\r\n\r\nHas your data been accessed?\r\n----------------------------\r\n\r\nIf we have not already contacted you directly about possible access to\r\nyour data, we do not believe the data on your virtual machines was\r\naccessed.\r\n\r\nBefore the deletion, the attacker made temporary copies from six\r\nexisting platform snapshots. Four of these belonged to two customers,\r\nand we contacted both directly on 30 September 2026. The other two were\r\nof an internal system that held no customer data. We have found no\r\nevidence that any data was taken from customers' virtual machines, and\r\nthe file the attacker has published contains none, which further\r\nindicates they were unable to take it. It is not possible to rule this\r\nout completely.\r\n\r\nSeparately, the attacker took basic account records from the control\r\npanel and has since published them: a 5.77 KB file of first names, last\r\nnames and obfuscated email addresses, and nothing more.\r\n\r\nVirtual machines affected:\r\n  46, all on FRA1, deleted together with their platform snapshots\r\n\r\nData that may have been accessed:\r\n  Data from two customers, through temporary copies of four of their\r\n  platform snapshots. Both have been contacted directly\r\n\r\nData published by the attacker:\r\n  A 5.77 KB file of control-panel account records: first names, last\r\n  names and obfuscated email addresses only\r\n\r\nOther locations and systems:\r\n  No evidence that any other Dediserve location, our billing systems or\r\n  any other iomart Group system was affected\r\n\r\nWhat happened: timeline and cause\r\n---------------------------------\r\n\r\nThe attacker used login credentials belonging to a member of staff at a\r\nthird-party provider that supports the platform. We believe the\r\ncredentials were exposed at some point before the attack, most likely\r\nthrough malware on a device. All times below are UK time (BST, UTC+1).\r\n\r\n27 September, 11:00\r\n  The attacker uses the stolen credentials to connect to the platform's\r\n  management system.\r\n\r\n27 September, 11:56 to 28 September, 05:29\r\n  The attacker makes temporary copies from six existing platform\r\n  snapshots and resets the administrator passwords on those copies.\r\n  Customers' live virtual machines are not changed.\r\n\r\n28 September, 06:53\r\n  An automated script deletes all 46 virtual machines on the platform,\r\n  with their platform snapshots and user accounts.\r\n\r\n28 September, 07:20\r\n  The attacker emails our service desk demanding payment, and our\r\n  monitoring shows the impact. Our incident response begins.\r\n\r\n28 September, 15:25\r\n  We send an initial notice to customers.\r\n\r\n30 September, 16:12\r\n  We notify all customers on the platform. The two customers whose\r\n  backup copies may have been accessed are notified separately at 16:53.\r\n\r\nRoot cause\r\n\r\nCompromised credentials belonging to a member of staff at a third-party\r\nsupport provider, which gave administrative access to the platform's\r\nmanagement system.\r\n\r\nContributing factors\r\n\r\n- Access to the platform's management system relied on the support\r\n  provider's credentials, so once those credentials were exposed they\r\n  could be used by someone else. We have since strengthened the controls\r\n  around this access.\r\n- The platform's backup feature keeps local, unverified snapshots on the\r\n  same platform by design. It is not a separate backup service, so the\r\n  same administrative access could delete both the virtual machines and\r\n  their snapshots.\r\n\r\nThe attacker's demand and claims\r\n\r\nThe attacker contacted us with a payment demand and with claims about\r\ndata they hold. We have not engaged with the attacker and will not pay.\r\n\r\nThe attacker has since published the data it took: a 5.77 KB file of\r\naccount records from the platform's control panel, containing first\r\nnames, last names and obfuscated email addresses. It contains no\r\npasswords, payment card, billing or other customer information, and none\r\nof the data held on customers' virtual machines.\r\n\r\nWhat it means for you, and what you can do\r\n------------------------------------------\r\n\r\n- Your data on FRA1. Virtual machines and their platform snapshots were\r\n  permanently deleted and cannot be recovered, despite every available\r\n  recovery route being tried. Services need to be restored from your own\r\n  backups, and our support team can help.\r\n- Credentials. As a general precaution, we recommend changing any\r\n  passwords, keys or other credentials that were used on your FRA1\r\n  servers.\r\n- Be alert to phishing. The published details could be used to make\r\n  fraudulent messages look genuine. Please report any unexpected message\r\n  about this incident through the support portal rather than responding.\r\n\r\nWhat we have done: containment and improvements\r\n-----------------------------------------------\r\n\r\n- Removed the attacker's access, disabled the compromised account and\r\n  rotated administrative credentials across our OnApp platforms.\r\n- Rebuilt remote administrative access with stronger authentication,\r\n  limited to approved locations.\r\n- Replaced shared support accounts with a unique account for each\r\n  platform.\r\n- Reviewed platform, server and network records to establish what the\r\n  attacker did.\r\n- Added retention protection to our backup storage.\r\n- Reported the incident directly to Police Scotland, the UK National\r\n  Cyber Security Centre and the National Cyber Security Centre in\r\n  Ireland. Police Scotland informed An Garda S\u00edoch\u00e1na on our behalf.\r\n\r\nWe are continuing to review our controls across all our platforms. We\r\nregret the disruption this incident has caused.\r\n\r\nContact us: questions and support\r\n---------------------------------\r\n\r\nIf you have any questions about this incident, please contact our Data\r\nProtection Officer at dpo@iomart.com, quoting reference DDS-2026-09-28.\r\n\r\nData Protection Officer\r\ndpo@iomart.com\r\nDediserve, part of the iomart Group\r\n\r\nProvided for information only and without admission of liability. It\r\nreflects our understanding at the date of issue and does not vary your\r\nagreement with us.","portuguese-br":"","german":"","arabic":"","farsi":"","french":"","danish":"","dutch":"","polish":"","spanish":"","swedish":"","turkish":"","portuguese-pt":"","chinese":"","japanese":""}]]></description>
</item>
</channel>
</rss>