Customers of Rackspace Technology have experienced interruptions due to a ransomware attack on the Windcrest-based tech services provider. Credit: Bonnie Arbittier / San Antonio Report

This story has been updated.

The San Antonio-based technology services company Rackspace Technology has confirmed that a ransomware attack was responsible for connectivity issues that began affecting customers last Friday.

The interruption is ongoing and could result in $30 million of losses in the company’s annual revenue, a statement said. The company’s stock price, which was just under $5 on Friday, opened at $3.88 on Wednesday and is down about 19% in the past five days.

Ransomware is a type of malware that threatens to publish a victim’s personal data or block access to data unless a ransom is paid. Rackspace, which confirmed the breach Tuesday, has declined to identify a possible source of the attack or whether it has paid a ransom. 

The ransomware affected the company’s hosted exchange customers. Hosted exchange is a service that provides email and server space.

Rackspace began investigating the suspicious activity within its hosted exchange environments on Friday after users hit an error when they tried to access the Outlook Web App and sync email clients. 

By Monday, the company released a notice that it had successfully restored email services to “thousands of customers” on the Microsoft 365 platform. 

The Hemisfair Conservancy was one of many impacted by the outage; while the nonprofit’s email accounts are now back up, it sent out an email Wednesday afternoon asking anyone who had sent an email in the past five days, “will you kindly resend it?”

Rackspace said its internal security team has hired a leading cyber defense firm to help investigate the breach, which Rackspace believes is isolated to its hosted exchange business. 

A status update posted to the Rackspace website on Wednesday morning stated that the investigation is still in its early stages: “It is too early to say what, if any, data was affected. If we determine sensitive information was affected, we will notify customers as appropriate.”

Other products and services provided by the multi-cloud tech company, such as Rackspace Email, are still operating as usual, according to the statement. Rackspace’s hosted exchange users and their domains have been migrated to the Microsoft 365 software platform.

In June 2021, Judson Independent School District officials confirmed that the district had been the victim of a ransomware attack, leaving district staff unable to access email or phone lines and other systems connected to the internet.

That year, there were 623 million ransomware attacks worldwide, according to the data site Statista.

Founded in 1998, Rackspace has suffered growing losses in recent years and is looking to sell off parts of the company. A plan hatched earlier this year to sell the entire company was ultimately cast aside.

In September, Rackspace installed its fifth CEO in the last six years, Amar Maletira, replacing Kevin Jones, whose exit came with an extra year of compensation.

In late October, Rackspace announced the company would be moving from its Windcrest headquarters in a former shopping mall to a smaller office space in North San Antonio.

Rackspace had occupied what it called the “Castle” northeast of San Antonio since 2007. The new office is located north of Loop 1604 and near U.S. Highway 281. The private equity firm Apollo Global Management bought the company in 2016 in a $4.3 billion deal.

Avatar photo

Shari Biediger

Shari Biediger is the development beat reporter for the San Antonio Report.