Rackspace Hosted Exchange Ransomware: The Outage That Killed a Legacy

Quick Answer — On December 2, 2022, Rackspace disclosed a “security incident” in its Hosted Exchange business; within days it was confirmed ransomware, and customers’ email stayed down for weeks. The product never came back — it was killed, and customers were migrated to Microsoft 365. The final toll: tens of thousands of paying customers offline, an ~$12M-plus incident cost per filings, and a hard lesson: a “legacy” multi-tenant platform you can’t retire quietly becomes the outage that retires you.

What happened

• December 2: Rackspace reports “security incident” and service disruption for Hosted Exchange; 911-style status updates follow. Core product: Microsoft Exchange in shared Rackspace-run infrastructure for small and midsize businesses.
• December 5–6: Company confirms it isolated the environment; incident response (CrowdStrike) engaged. Customers still blacked out.
• December 9 (8-K filing): Rackspace acknowledges the incident is expected to have a material impact; later filings estimate ~$12M incident-related costs.
• December 13: Formal statement confirms ransomware was the cause; the company pivots customers toward Microsoft 365 and begins sunsetting the legacy Exchange offering.
• Attribution: Reporting tied the intrusion to the Play ransomware operation; Rackspace kept attribution language minimal in official filings.

Impact snapshot

Why this incident structure is so brutal

Hosted Exchange was a shared-platform monoculture: one email stack, professionally run but aging, serving thousands of tenants whose businesses depended on it. That architecture multiplies ransomware’s leverage three ways. First, one intrusion becomes everyone’s outage — isolation of the environment to stop encryption meant cutting off every customer simultaneously. Second, restoration equals migration: you can’t “restore” a legacy shared platform the attackers understand better than your own runbooks; Rackspace’s pragmatic answer was to move the world to a different service. Third, communication debt compounds technical debt: early “security incident” phrasing left customers guessing for days, and each ambiguous update became its own reputational damage stream.

Timeline

Lessons for service providers and their customers

• Legacy platforms need end-of-life security budgets. If a product can’t be modernized, its isolation, monitoring, and IR runbooks deserve more investment, not less — it’s the platform attackers know best.
• Tenant isolation is the whole game in shared infra. Flat internal trust means one foothold crosses every customer boundary; segment per-tenant paths and assume compromise of the management plane.
• Practiced restoration beats perfect prevention. Rackspace’s recovery meant mass migration, not restore — providers must know, per product, which one they’re actually capable of, and rehearse it.
• Own the comms. Affected SMBs needed day-one honesty: what’s down, what’s at risk, what to tell their own customers. Vague incident language has a body count.
• Customers: provider redundancy is cheap insurance. A secondary MX, cached mail, exported PSTs — any of these would have softened a multi-week total outage for a small business.

Why it still matters in 2026

The Rackspace incident became the reference case for supply-chain email outages as business-ending events — not because data loss was uniquely large, but because it showed continuity failing wholesale for an entire product’s customer base at once. It accelerated two shifts: providers moving SMB email to hyperscaler platforms (with the risk concentration that implies), and customers demanding contractual RTO/RPO commitments with teeth plus documented exit and export paths. In 2026’s environment of recurring MSP and provider compromises, the December 2022 lesson stands: the question isn’t only “is our provider secure” but “what happens to our business the week their platform doesn’t come back.”

Was customer data stolen?

Rackspace’s statements acknowledged data was staged/accessed for some customers during the intrusion, but the company never published a comprehensive data-impact accounting — a point of ongoing criticism and litigation. The honest summary: exfiltration was plausible-to-confirmed for portions of the base, unspecified in scope, and rendered moot for many by the product’s retirement.

Why couldn’t they just restore from backups?

Public reporting and expert analysis converge on: the compromise predated detection long enough that clean restoration of a legacy shared Exchange estate was judged infeasible within any reasonable time — hence migration as “recovery.” Shared platforms multiply restore complexity: tenant data, configs, and trust relationships interlock, and validating clean state across all of them post-ransomware is slower than rebuilding elsewhere.

What is Play ransomware?

A criminal operation (also seen as PlayCrypt) active since mid-2022, known for double extortion and repeated strikes at managed service providers and corporate email estates — including documented exploits of Exchange vulnerabilities and edge-device footholds. Attribution of the Rackspace intrusion to Play came from incident-response reporting; Rackspace itself did not formally name the group.

Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.

Detection and response playbook

The Rackspace Hosted Exchange ransomware (December 2022) encrypted a legacy multi-tenant email platform and took it offline permanently — the incident that finally retired an architecture the industry had been warning about for years. For service providers and their customers, the playbook is about legacy platforms, communication during multi-week outages, and exit planning.

1. Inventory legacy platforms with an honest end date. Every managed-service portfolio carries products past vendor support — the Exchange 2010/2013 era here. The risk register entry needs three fields: number of tenants, dependency map, and a decommission date with an owner. Unsupported internet-facing mail platforms are the single most predictable catastrophe in the provider catalog.
2. Detect the intrusion class before encryption. Exchange compromises announce themselves in mail-flow anomalies: transport rule changes, new mailbox delegations, unusual MAPI session volumes, and staging of mailbox exports. Multi-tenant platforms need per-tenant anomaly baselines, because the aggregate hides the individual compromise until the encryptor arrives.
3. Prepare the comms plane before you lose the primary one. The cruelest design flaw of this incident: the outage took the email system that customers would have used for outage communication. Providers need an out-of-band status channel — status page, SMS tree, alternative mail domain — tested in advance, plus escalation contacts for every tenant that live outside the platform being protected.
4. Segment tenants like the blast radius depends on it. Multi-tenant legacy platforms often share authentication and storage across customers, so one encryption event hits all. Modern architectures shard tenants; if the platform cannot, the compensating control is per-tenant backup separation and rapid tenant-level restore — tested, not assumed.
5. Contract the exit path in advance. Customers who migrated before the incident kept their mail; the ones trapped in the outage learned the difference between having data and having access. Every managed-service contract should specify export formats, migration assistance, and continuity terms — the exit path is part of the product, and this incident priced its absence in weeks of downtime.

Where this sits in the broader pattern

Rackspace Hosted Exchange joined the legacy-platform catastrophe genre: the 2021 Kronos workforce-platform ransomware that stranded payroll for weeks, the Change Healthcare event that followed the same single-vendor-becomes-national-infrastructure shape, and every on-premises-Exchange emergency since ProxyLogon. The common structure: aging platform, deep customer dependency, ransomware detonation, multi-week outage, and a migration nobody had scheduled suddenly scheduled by force.

The provider dimension distinguishes it. Individual enterprises can absorb an email outage; a provider aggregates thousands of organizations into one incident, converting operational risk into sector risk. That aggregation is why regulators increasingly treat managed providers as critical infrastructure — and why provider-side security (segmentation, per-tenant recovery, out-of-band comms) is now a customer-side procurement question rather than an internal matter.

The consolidation for readers: legacy plus dependency plus no exit plan equals eventual forced migration under the worst possible conditions. The MOVEit series covered the same shape on the file-transfer side; the WD My Cloud analysis covered it from the consumer angle. Every entry in the genre was survivable by the same trio — migrate deliberately, back up independently, communicate out-of-band.

The bottom line. The platform was past end-of-life, the tenants had no exit plan, and the outage outlived the incident by weeks. Legacy infrastructure with concentrated dependency is not a maintenance decision, it is a countdown — and the detonation date is chosen by someone else. Migrate on your schedule, verify per-tenant recovery actually works, and build the out-of-band channel before the band goes quiet.

One more provider-side artifact earns its cost here: a tenant-impact register — which customers, workloads, and dependencies map to each platform in the portfolio — maintained as part of normal operations. When the incident forces platform-level decisions in the first hour, that register is the difference between informed triage and a very long night of discovery.

And schedule the migration you already know you need. Every week of legacy operation is a wager placed at odds this incident published.

Legacy does not get safer while you schedule the meeting. The wager compounds weekly.

Frequently Asked Questions

{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”What happened to Rackspace Hosted Exchange in December 2022?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”A ransomware attack encrypted Rackspace legacy Hosted Exchange environment, permanently ending the service. Tens of thousands of customers lost email access for days to weeks, with a migration to Microsoft 365 forced under outage conditions.”}},{“@type”:”Question”,”name”:”Why did the Rackspace outage last so long?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”The attacked platform was a legacy multi-tenant Exchange deployment past mainstream support, and the encryption event forced a rebuild-and-migrate rather than a restore — compounded by the loss of email as the coordination channel for the response itself.”}},{“@type”:”Question”,”name”:”What is the lesson for customers of managed service providers?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Contract the exit path (export formats, migration assistance, continuity terms), maintain independent backups of provider-hosted data, and keep out-of-band contacts with the provider — because provider incidents become your outage on the provider timeline.”}}]}

Related Reading

• What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
• Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
• 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
• Authoritative reference: CISA Known Exploited Vulnerabilities

More on this topic

• Western Digital’s My Cloud Outage: Vendor Risk for NAS
• ESXiArgs: The Ransomware Wave That EncryptEd Whole Estates
• Ransomware at a Gas Compression Facility: CISA’s OT Alert

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy