ProtonMail, a Swiss firm that provides end-to-end encrypted
e-mail, said in a statement that it had paid a ransom of almost $6,000 to stop an
advanced denial-of-service (DDOS) attacks that forced the company to shut down
its website.
The money had been sent to the bitcoin address 1FxHcZzW3z9NRSUnQ9Pcp58ddYaSuN1T2y.
“This was a collective decision taken by all impacted
companies, and while we disagree with it, we nevertheless respected it taking
into the consideration the hundreds of thousands of Swiss Francs in damages
suffered by other companies caught up in the attack against us. We hoped that
by paying, we could spare the other companies impacted by the attack against
us, but the attacks continued nevertheless. This was clearly a wrong decision
so let us be clear to all future attackers – ProtonMail will NEVER pay another
ransom,” the company said in the statement.
ProtonMail received a note from unknown criminals threatening
to blast it off the internet just before midnight on November 2 unless a 15 BTC
($5,500 at time of writing) ransom was paid.
However, the company ignored the demand, and the next
morning a 15-minute attack knocked its servers’ offline. A few hours later the
assault resumed, this time with an "unprecedented level of sophistication.”
“At around 2PM, the attackers began directly attacking the
infrastructure of our upstream providers and the datacenter itself. The
coordinated assault on our ISP exceeded 100Gbps and attacked not only the
datacenter, but also routers in Zurich, Frankfurt, and other locations where
our ISP has nodes. This coordinated assault on key infrastructure eventually
managed to bring down both the datacenter and the ISP, which impacted hundreds
of other companies, not just ProtonMail,” the firm said.
Today, the website remains offline, submerged by unknown
assailants.
ProtonMail said that its IT infrastructure can't handle any
more floods of duff traffic, and is going to need an upgrade. The firm
estimates that this will cost $100,000 and has launched a funding page that has
already garnered over $25,000 in donations.
“Over the next several weeks, we will begin putting in place
the sophisticated protections that are necessary to withstand large scale
attacks like this to ensure that online privacy can’t be taken down,” the firm
added.