Jake Hildreth (acorn) :blacker_heart_outline:@TheGibson Everyone in my org received an identical phishing link in the wee hours of Monday morning. Since I spotted the message before the majority of users had logged on, I decided to use a PowerShell script to delete all messages matching that subject line. I fired off the script and started my drive to work.
When I arrived in the office, I noticed the script was still running and was a bit confused. I'd used this script many times in the past; deleting a single message from all users' mailboxes should have been a quick affair.
But I did something wrong (still not sure what) involving wildcards. Instead of a single message being removed from all mailboxes, ALL messages were being deleted from ALL mailboxes. FAH.
I Ctrl+C'd that thing quickly and went into recovery mode. I was able to restore from a backup taken ~6 hours earlier. The only messages that were completely lost were those received between that backup and the time I started the recovery.
Thankfully, the script deleted messages from the newest mailboxes first. Since we'd just hired a bunch of seasonal workers who barely used their computers, there was almost no data loss.
Somehow, the game of telephone mangled "dude in IT fucked up" into "org was hacked", and the local media picked up the story. The local media contacted my boss' boss' boss for comment. She was completely unaware of the issue, so she called me late in the evening to ask me about the "hack" we'd suffered.
The only hack in this story is me, boss.
v̾i̾t̾r̾i̾o̾l̾i̾x̾
All GNU social JP content and data are available under the