In January 2026, users reported unavailable CloudCone servers and an SSH warning directing them to a Telegram account for payment. The screenshot in the original article records such a message; it is not a complete forensic account of the incident.
The original post quoted a $150 demand, a large amount compared with some low-cost hosting plans. It did not establish the full number of affected customers, how access was obtained, or whether payment restored any data.
My original claim that small providers inevitably suffer compromise was too broad. Provider size alone does not determine security. An unverified payment demand also does not establish that the sender can restore the server.
The practical lesson is independent backup: keep a copy outside the hosting account and periodically test restoration. For an incident affecting your own server, preserve the available evidence and contact the provider through verified support channels. Check CloudCone’s incident history for official notices rather than treating a ransom message as support.
Adapted from the original Chinese article, published on January 30, 2026.
Comments NOTHING