DISH Hacked - Websites are BACK ONLINE!

[Bobby]

Wait, Dish isn't paying their techs during their inability to dispatch workorders?

Maybe their company workers but how about the contract workers...

 

[Conway]

I would hope Dish is paying! It wasn't the techs fault they were hacked!

 

[jwhalerfan]

Wait, Dish isn't paying their techs during their inability to dispatch workorders?

Not the thousands of 1099 sub-contractors. I suppose that should be up to the contracting companies, but either way, we're temporarily out of work.
I'm not blaming anyone or saying they SHOULD pay something. Not at all. Just saying this is harder on us than it is to those who can't log into an app for a week

 

[HipKat]

Wait, Dish isn't paying their techs during their inability to dispatch workorders?

Not sure how inhouse is doing it but our company is putting something together or the techs with or in lieu of PTO.

Here's where things are at.
The main objective is to create work orders, so websites, etc are not on a priority list.
Over the last 3 days, the number of new work orders created has about doubled, but there are still very few.
I don't know if more than 1 call center is open yet.
One of the biggest issues is Tech's logging into the app/website used for routing and completing jobs and activating receivers, which has been a very painstaking process where receiver numbers and work orders are compiled and sent to Dish for activating, which they're doing in batches.
Tech passwords work one day, then the next they may not. There were literally 2 people working on getting techs passwords changed and logged in for the entire country. That may have changed in the last day or two.
I'm not on managers' calls with Dish but I am on managers' calls and distros in the company and info from Dish is being passed along as it comes in.

I cannot begin to imagine the amount of money lost from the top down to the call center people and everyone in between.

 

[HipKat]

This is the verbiage we've been given to pass on to customers who have questions.

General Public Statement:

On February 23, we experienced a cybersecurity incident that has affected some of our internal communications, customer call centers, and internet sites. We immediately activated our incident response and business continuity plans to contain, assess and remediate the situation. We retained the services of cybersecurity experts and outside advisors to assist in the evaluation of the situation, and we notified appropriate law enforcement authorities.
On February 27, we became aware that certain data was extracted from our IT systems as part of this incident. It's possible the investigation will reveal that the extracted data includes personal information. The forensic investigation and assessment of the impact of this incident is ongoing. The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.
As a result of this incident, many of our customers are having trouble reaching our service desks, accessing their accounts, and making payments. We're making progress on the customer service front every day, including ramping up our call capacity, but it will take a little time before things are fully restored. Our DISH TV, Sling TV, Wireless services, and data networks continue to operate and are up and running.

APPROVED REACTIVE MESSAGING REGARDING INCIDENT:

What happened?

• On February 23, we experienced a cybersecurity incident that has affected some of our internal communications, customer call centers, and internet sites. We immediately activated our incident response and business continuity plans to contain, assess and remediate the situation.
• On February 27, we became aware that certain data was extracted from our IT systems as part of this incident. It's possible the investigation will reveal that the extracted data includes personal information.
• The forensic investigation and assessment of the impact of this incident is ongoing.
• The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.

How did it happen?

• I don't have an answer for you today. The forensic investigation and assessment of the impact of this incident is ongoing.

What was impacted?

• On February 23, we experienced a cybersecurity incident that has affected some of our internal communications, customer call centers, and internet sites. We immediately activated our incident response and business continuity plans to contain, assess and remediate the situation.
• As a result of this incident, many of our customers are having trouble reaching our service desks, accessing their accounts, and making payments. We're making progress on the customer service front every day, including ramping up our call capacity, but it will take a little time before things are fully restored.

What are you doing about it?

• We immediately activated our incident response and business continuity plans to contain, assess and remediate the situation. We retained the services of cybersecurity experts and outside advisors to assist in the evaluation of the situation, and we notified appropriate law enforcement authorities.

Is my security at risk? Is my account safe?

• It's possible the investigation will reveal that the extracted data includes personal information. The forensic investigation and assessment of the impact of this incident is ongoing. The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.
  • What are "appropriate steps"?
    • I don't have details today because the forensic investigation and assessment of the impact of this incident is ongoing.

Was data stolen?

• On February 27, we became aware that certain data was extracted from our IT systems as part of this incident. It's possible the investigation will reveal that the extracted data includes personal information. The forensic investigation and assessment of the impact of this incident is ongoing. The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.
  • What are "appropriate steps"?
    • I don't have details today because the forensic investigation and assessment of the impact of this incident is ongoing.

Do I need to call my bank to cancel my credit cards, or change my passwords?

• The forensic investigation and assessment of the impact of this incident is ongoing. The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.
  • What are "appropriate steps"?
    • I don't have details today because the forensic investigation and assessment of the impact of this incident is ongoing.

When will you know what data was affected?

• These investigations take time and the assessment of the impact of this incident is ongoing.
• Our teams, along with external forensics experts, are working as quickly as possible to analyze the information.
• The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.

When will things be fully restored?

• We're making progress on the customer service front every day, including ramping up our call capacity, but it will take a little time before things are fully restored. Our DISH TV, Sling TV, Wireless services, and data networks continue to operate and are up and running.

What are you doing to restore systems?

• I don't have that information but we did immediately activate our incident response and business continuity plans to contain, assess and remediate the situation.

Are you able to follow up with us when your systems are back online?

• Our teams are working around the clock to restore affected systems as quickly as possible, and we are making steady progress. We hope to have mydish.com back up and running soon. It will be updated with the latest information and will be the best place to get updates.

Supervisor request

• Since we're taking so many calls, our supervisors that are staffed are taking calls with us. I'm empowered to help you with all options that are available right now.

What are you doing to keep this from happening again?

• As we work to bring affected systems back online, we are completing a full review of our security posture, and are making enhancements in the areas of network security, endpoint security and application security.

Billing/Account

Will I be charged any late fees for not being able to make a payment on time?

• When our systems are back up, we will review accounts for late fees that occurred while customers were unable to make payments, and those late fees will be removed.

I had a future-dated DISH Pause on my account. Will my account be credited for the time it remained active?

• When our systems are back up, we'll review accounts for any fees that occurred during the systems issue.

Is there any information on my New Customer Offer?

• I'm unable to bring up your account to see the information. Once our operations are restored, you'll be able to access your account online.

Wants to pay bill, will my service be shut off in the meantime?

• If you are affected, you will not lose your service while we're resolving this issue. Thanks for being a valued DISH customer.

Trying to make changes to my service (cancel, other) and can't.

• We're sorry for the inconvenience. We'll be able to help you out as soon as our systems are back up, and we'll work with you so you do not pay for additional days of service.

Technical

When will I be able to use my DISH passwords on ESPN, USA Network, NBC, AppleTV, ROKU, etc.?

• Our IT teams are working to restore the issue as fast as possible, and we're making steady progress.

When will I be able to watch DISH Anywhere?

• We're working to restore this as soon as possible. In the meantime, you can always use your in-home equipment (Hopper, VIP etc.). If you are not in the home, there is some content available on DISH Anywhere without logging in.

My technician never showed up/I never heard back about my technician appointment.

• I'm sorry that happened. I have a process to send a communication to the technician's local office. From there, they will be able to work with you on a resolution.

 

[charlesrshell]

This is the verbiage we've been given to pass on to customers who have questions.

General Public Statement:

On February 23, we experienced a cybersecurity incident that has affected some of our internal communications, customer call centers, and internet sites. We immediately activated our incident response and business continuity plans to contain, assess and remediate the situation. We retained the services of cybersecurity experts and outside advisors to assist in the evaluation of the situation, and we notified appropriate law enforcement authorities.
On February 27, we became aware that certain data was extracted from our IT systems as part of this incident. It's possible the investigation will reveal that the extracted data includes personal information. The forensic investigation and assessment of the impact of this incident is ongoing. The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.
As a result of this incident, many of our customers are having trouble reaching our service desks, accessing their accounts, and making payments. We're making progress on the customer service front every day, including ramping up our call capacity, but it will take a little time before things are fully restored. Our DISH TV, Sling TV, Wireless services, and data networks continue to operate and are up and running.

APPROVED REACTIVE MESSAGING REGARDING INCIDENT:

What happened?

• On February 23, we experienced a cybersecurity incident that has affected some of our internal communications, customer call centers, and internet sites. We immediately activated our incident response and business continuity plans to contain, assess and remediate the situation.
• On February 27, we became aware that certain data was extracted from our IT systems as part of this incident. It's possible the investigation will reveal that the extracted data includes personal information.
• The forensic investigation and assessment of the impact of this incident is ongoing.
• The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.

How did it happen?

• I don't have an answer for you today. The forensic investigation and assessment of the impact of this incident is ongoing.

What was impacted?

• On February 23, we experienced a cybersecurity incident that has affected some of our internal communications, customer call centers, and internet sites. We immediately activated our incident response and business continuity plans to contain, assess and remediate the situation.
• As a result of this incident, many of our customers are having trouble reaching our service desks, accessing their accounts, and making payments. We're making progress on the customer service front every day, including ramping up our call capacity, but it will take a little time before things are fully restored.

What are you doing about it?

• We immediately activated our incident response and business continuity plans to contain, assess and remediate the situation. We retained the services of cybersecurity experts and outside advisors to assist in the evaluation of the situation, and we notified appropriate law enforcement authorities.

Is my security at risk? Is my account safe?

• It's possible the investigation will reveal that the extracted data includes personal information. The forensic investigation and assessment of the impact of this incident is ongoing. The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.
  • What are "appropriate steps"?
    • I don't have details today because the forensic investigation and assessment of the impact of this incident is ongoing.

Was data stolen?

• On February 27, we became aware that certain data was extracted from our IT systems as part of this incident. It's possible the investigation will reveal that the extracted data includes personal information. The forensic investigation and assessment of the impact of this incident is ongoing. The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.
  • What are "appropriate steps"?
    • I don't have details today because the forensic investigation and assessment of the impact of this incident is ongoing.

Do I need to call my bank to cancel my credit cards, or change my passwords?

• The forensic investigation and assessment of the impact of this incident is ongoing. The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.
  • What are "appropriate steps"?
    • I don't have details today because the forensic investigation and assessment of the impact of this incident is ongoing.

When will you know what data was affected?

• These investigations take time and the assessment of the impact of this incident is ongoing.
• Our teams, along with external forensics experts, are working as quickly as possible to analyze the information.
• The security of our customers' data is important to us, and if we learn that information was compromised, we'll take the appropriate steps and let any impacted customers know.

When will things be fully restored?

• We're making progress on the customer service front every day, including ramping up our call capacity, but it will take a little time before things are fully restored. Our DISH TV, Sling TV, Wireless services, and data networks continue to operate and are up and running.

What are you doing to restore systems?

• I don't have that information but we did immediately activate our incident response and business continuity plans to contain, assess and remediate the situation.

Are you able to follow up with us when your systems are back online?

• Our teams are working around the clock to restore affected systems as quickly as possible, and we are making steady progress. We hope to have mydish.com back up and running soon. It will be updated with the latest information and will be the best place to get updates.

Supervisor request

• Since we're taking so many calls, our supervisors that are staffed are taking calls with us. I'm empowered to help you with all options that are available right now.

What are you doing to keep this from happening again?

• As we work to bring affected systems back online, we are completing a full review of our security posture, and are making enhancements in the areas of network security, endpoint security and application security.

Billing/Account

Will I be charged any late fees for not being able to make a payment on time?

• When our systems are back up, we will review accounts for late fees that occurred while customers were unable to make payments, and those late fees will be removed.

I had a future-dated DISH Pause on my account. Will my account be credited for the time it remained active?

• When our systems are back up, we'll review accounts for any fees that occurred during the systems issue.

Is there any information on my New Customer Offer?

• I'm unable to bring up your account to see the information. Once our operations are restored, you'll be able to access your account online.

Wants to pay bill, will my service be shut off in the meantime?

• If you are affected, you will not lose your service while we're resolving this issue. Thanks for being a valued DISH customer.

Trying to make changes to my service (cancel, other) and can't.

• We're sorry for the inconvenience. We'll be able to help you out as soon as our systems are back up, and we'll work with you so you do not pay for additional days of service.

Technical

When will I be able to use my DISH passwords on ESPN, USA Network, NBC, AppleTV, ROKU, etc.?

• Our IT teams are working to restore the issue as fast as possible, and we're making steady progress.

When will I be able to watch DISH Anywhere?

• We're working to restore this as soon as possible. In the meantime, you can always use your in-home equipment (Hopper, VIP etc.). If you are not in the home, there is some content available on DISH Anywhere without logging in.

My technician never showed up/I never heard back about my technician appointment.

• I'm sorry that happened. I have a process to send a communication to the technician's local office. From there, they will be able to work with you on a resolution.

Thanks HipKat

 

[Josephinelcajon]

Tha

That would be nice if it were true. Unfortunately, a company the size of Dish is not dealing with just one system, rather it's multiple interconnected systems that need to be thoroughly examined by forensic data specialists to determine how the initial entry was made so the rebuild process can be protected from repeated attacks. Restoring the operating systems is the easiest part of the process, restoring the highly fluid data in multiple databases as fully as possible is the difficult part. It's not an easy process, and I speak as a retired multi-national company systems administrator/analyst that has overseen similar rebuilds caused by various disasters from fires to earthquakes and tornadoes.

I was fortunate to not have to deal with a ransomeware attack during my pre-retirement career, but I did assist with one attack as a post-retirement consultant for a small ~900 employee manufacturing company. We got them back in operation in about 5 days working almost around the clock, but getting everything fully back to normal too another couple of weeks of piecing things together using airgapped systems to pull pertinent records out of the corrupted data. I'm very glad I'm not involved in the recovery process a company the size and complexity of Dish and it's connected companies involves.

Thankfully Dish had

On another note, we're 9 days out of work. There are thousands of techs unable to pay their bills this month.
And you can pay HBO directly instead of Dish. You'll even get a week free, then cancel it. Problem easily solved. Dish will credit you for the inconvenience, but they won't cover our lost wages.

This or worse that Dish might lose so many customers it's no longer worth it were my greatest fears in this! They may not be able to pay them. Frozen accounts, customers unable to pay who knows.

 

[Miner]

This hack (probably ransomware attack) recently happened with Rackspace hosting, and a couple of years ago with a medical company here in San Diego.

I wonder if Dish paid for their data back or had a solid restore system?

It is times like this when I'm glad I got out of IT.

 

[navychop]

If they paid, I'd think it would be back up fully by now.

 

[Scott Greczkowski]

I think so far just one as they have access to things without the network being exposed to the internet.


Sent from my iPhone using Tapatalk

 

[Scott Greczkowski]

If they paid would the holes still be open for them to come back in and take more data then lock them out again?

I wouldn't pay.


Sent from my iPhone using Tapatalk

 

[comfortably_numb]

I wouldn't pay.

I agree. It's the same as negotiating with terrorists.

 

[navychop]

Actually, I've had no trouble negotiating with the IRS on behalf of others.

 

[TheLip]

If they paid would the holes still be open for them to come back in and take more data then lock them out again?

I wouldn't pay.


Sent from my iPhone using Tapatalk

I am not advocating that they should pay, in fact, if no one ever paid these extortions would stop. They might steal data, but that would be the extent.

However, as stupid as it sounds, when these groups do get paid they almost always keep their end of the deal. It doesn't end up being a running extortion.

 

[primestar31]

However, as stupid as it sounds, when these groups do get paid they almost always keep their end of the deal. It doesn't end up being a running extortion.

Paying blackmailers, and that's all these guys REALLY are, only encourages them to keep doing it. Nobody should EVER pay, no matter what. I don't know what Dish's network security is, or how hardened their network was, but quite obviously, it was not good enough.

 

[vulcanccit]

Keep monitoring it and let us know if it fails again.

Well yesterday, Friday, we had another set of rain storms, and now I am out again, like it was when I first posted screen shots. So I did a few test installations, and got the same results, then I did a third test installation, I think after unplugging the system, and now it says Node N.C. and Switch None, Reception Reception Error. So does this mean my switch died up on the switch? I read somewhere you can clear that buy doing the test installation without the RG6 plugged in the back, so I did that after a power down/up and then did a test installation, and then plugged it in, did a power down/up and a test installation and still Node: N.C. Switch: None. This is frustrating. Any ideas? Do I need a tech? Switch to Xfinity? lol

 

[primestar31]

Well yesterday, Friday, we had another set of rain storms, and now I am out again, like it was when I first posted screen shots. So I did a few test installations, and got the same results, then I did a third test installation, I think after unplugging the system, and now it says Node N.C. and Switch None, Reception Reception Error. So does this mean my switch died up on the switch? I read somewhere you can clear that buy doing the test installation without the RG6 plugged in the back, so I did that after a power down/up and then did a test installation, and then plugged it in, did a power down/up and a test installation and still Node: N.C. Switch: None. This is frustrating. Any ideas? Do I need a tech? Switch to Xfinity? lol

Is your dish shadowed by ANY trees at all? If so, wet leaves could cause blockage. If NOT, then I'd say water is getting into something it should NOT.

 

[vulcanccit]

Is your dish shadowed by ANY trees at all? If so, wet leaves could cause blockage. If NOT, then I'd say water is getting into something it should NOT.

No it is a clear shot but it would not even see the leaves if it thinks there is no switch correct? as well as no Node? Also today is sunny, warm and dry....

 

[jwhalerfan]

Well yesterday, Friday, we had another set of rain storms, and now I am out again, like it was when I first posted screen shots. So I did a few test installations, and got the same results, then I did a third test installation, I think after unplugging the system, and now it says Node N.C. and Switch None, Reception Reception Error. So does this mean my switch died up on the switch? I read somewhere you can clear that buy doing the test installation without the RG6 plugged in the back, so I did that after a power down/up and then did a test installation, and then plugged it in, did a power down/up and a test installation and still Node: N.C. Switch: None. This is frustrating. Any ideas? Do I need a tech? Switch to Xfinity? lol

Like I said before, there's an issue between the dish and receiver. Yes, you need a tech. The call center is online and you can book appts.

 

[BarnRat]

. . . when these groups do get paid they almost always keep their end of the deal. It doesn't end up being a running extortion.

Just curious ... where did you get this info?