

My view is that there is always another Shut down. Opinions are divided as to whether ProtonMail had options other than paying the blackmailers. Paying blackmailers is only going to encourage more attacks, and is making the internet a less safe place for all of us. All you have done is told the extortionists that you will consider giving them money for their crimes, and there is no guarantee that they – or other criminals – won’t try it again and again and again. Something I’m expecting we are going to see even more of in the years to come – whether it be in the form of attacks impacting website availability or the stealing of data with the threat of making it available to the public.īut the only reason criminals attempt to blackmail money out of anyone is because they believe there is a reasonable chance that we will pay the ransom.ĭon’t pay internet blackmailers. Impacted companies asked us to pay, we couldn't refuse. But that doesn’t mean I agree with how ProtonMail Over 100 companies were taken offline from the attack against us. We must not forget that they were the innocent victims of a crime, and there were clearly other innocent victims caught up in events too (ProtonMail’s users, the ISP, other companies who used the targeted data centre). The attack disrupted traffic across the ISP’s entire network and got so serious that the criminals who extorted us previously even found it necessary to write us to deny responsibility for the second attack.

Attacks against infrastructure continued throughout the evening and in order to keep other customers online, our ISP was forced to stop announcing our IP range, effectively taking us offline. We hoped that by paying, we could spare the other companies impacted by the attack against us, but the attacks continued nevertheless. This coordinated assault on key infrastructure eventually managed to bring down both the datacenter and the ISP, which impacted hundreds of other companies, not just ProtonMail.Īt this point, we were placed under a lot of pressure by third parties to just pay the ransom, which we grudgingly agreed to do at 3:30PM Geneva time to the bitcoin address 1FxHcZzW3z9NRSUnQ9Pcp58ddYaSuN1T2y. Set-cookie: Domain=protonmail.The coordinated assault on our ISP exceeded 100Gbps and attacked not only the datacenter, but also routers in Zurich, Frankfurt, and other locations where our ISP has nodes.
