ProtonMail held to ransom by cybercrooks

ProtonMail is an email service focused on privacy, favoured by journalists, activists and those who prioritize confidentiality. The service provider is known and has been commended for its message expiration feature that allows encrypted emails to self-destruct after a period of time. Approximately 500,000 users make use of the service.

ProtonMail has announced that it has been under sustained DDOS attack since November 3rd, 2015. The company advertises itself as being a secure email with no compromises, as brought by “CERN and MIT scientists”. It has been alleged that ProtonMail was subjected to 100GB worth of junk mail per second.

Proton has since announced that they are working with the Swiss Governmental Computer Emergency Response Team (GovCERT), the Cybercrime Coordination Unit Switzerland (CYCO), as part of an ongoing criminal investigation. Swiss authorities are looking into a group of cyber-criminals known as the Armada Collective. The group alleged to have been behind a rash of DDoS attacks.

The email provider suffered a coordinated assault on both its data centre and ISP, followed by a message demanding a ransom. ProtonMail paid the ransom of $6,000 in bitcoin (15 BTC) to the address 1FxHcZzW3z9NRSUnQ9Pcp58ddYaSuN1T2y. Sadly, the attacks against infrastructure persisted after the ransom was paid. ProtonMail has been criticized in some quarters for having paid the ransom, they have since expressed regret at having paid the ransom and have promised never to follow such protocol in future.

In order to keep other customers online, the ISP was forced to stop announcing their IP range which left ProtonMail without an online presence for several hours. Proton claim to have a long term solution to the security issues. A crowdsourcing fund has been announced on twitter for the purposes of financing measures to protect against future attacks.

The timing of this attack has been particularly unfortunate for ProtonMail in light plans to launch to a wider audience before the close of 2015, they have a waiting list for potential subscribers.