In late June 2021, owners of Western Digital My Book Live network-attached-storage devices logged in to find their files gone — wiped, replaced in many cases by a factory-reset box asking to be set up anew. Tens of thousands of the small personal backup drives, exposed to the internet, had been mass-wiped by remote commands at scale. WD’s investigation traced the wipe to attackers abusing a 2012-vintage command-injection vulnerability (unpatched forever on the discontinued device line) and running factory-reset commands across victims’ drives — while a separate, self-propagating Linux filesystem corrupter muddied the picture. The case became the textbook on consumer-IoT end-of-life risk: when a vendor abandons a device, exposure to the internet becomes an eventual total-loss condition.
Western Digital’s My Book Live (2009–2012-era personal NAS) suffered a mass-wiping incident starting 23 June 2021. Two distinct causes intertwined: (1) an attacker (or actors) exploited CVE-2011-1802-class command injection in the device’s deprecated web interface — the code path was four years old, never patched since the devices went end-of-support — issuing system-erase/factory-reset commands remotely to internet-exposed units; (2) an opportunistic Linux corrupter (a filesystem-wiping strain exploiting the same exposure class) destroyed data separately. Users lost backups, photos, and configuration; most never recovered anything. WD’s own forensics (published July 2021) confirmed the vulnerability-abuse chain and the reset command logs received from devices. Root causes, in order: EOL firmware with unpatched RCE, users port-forwarding/NAT-exposing a backup device never designed for hostile internet, and no segmented path for manufacturer emergency patches on dead product lines. The durable lesson is consumer-IoT end-of-life hygiene — retire, isolate, or assume loss — plus the operational rule that internet-exposed admin interfaces on any tier of device are an incident on layaway.
What happened
Reports surfaced 23–24 June 2021 on WD community forums and Reddit: My Book Live units showing factory-fresh state, data volumes gone. The devices had been discontinued in software terms for years — WD ended active security support long before, and the busybox-era firmware had known unpatched command-injection flaws documented since at least 2015 (a 2011 advisory on the My Book Live’s web interface had never been fixed on the line at all).
WD’s investigation (published as a detailed July 2021 report, unusually transparent for consumer IoT) reconstructed events from log data: attackers sent HTTP requests to exposed devices exploiting the legacy CGI vulnerability, obtaining command execution; those commands included factory-reset and system-erase operations, logging the characteristic reset signatures. Separately, a chunk of victims showed a different destruction pattern — filesystems corrupted by what researchers identified as a self-spreading Linux wiper using the same vulnerability class. WD found no evidence of its cloud infra involvement: the attack path was direct-to-device over the open internet (most victims had port-forwarded or UPnP-exposed the drive’s admin port).
The aftermath was bleak in the way only consumer incidents are: no ransom demand for most (the wiper just destroyed; the reset-crew’s motive stayed unclear — anti-forensics, trolling, or prep for resale scams), no backups for the backup device (single-device users), and no remediation path from the vendor beyond “disconnect it”. The incident joined the Mirai-cannon legacy canon of consumer-IoT failure — but with a nastier twist: this time the things themselves were the victims.
How it worked
The kill-on-contact sequence, from exposure to data death:
(1) EXPOSURE — home router forwards port (manual or UPnP) to
My Book Live admin interface; device sits on public IPv4
(some via CGNAT-relays/DDNS services)
(2) SCAN — attacker enumerates HTTP endpoints at scale; devices
fingerprint trivially (default pages, headers)
(3) INJECT — CVE-2011-era flaw in the admin CGI allows
unauthenticated command injection on firmware that stopped
receiving patches years earlier
(4) EXECUTE — commands issued:
(a) factory-reset / system-erase (WD-confirmed reset logs)
(b) deploy wiper payload (filesystem corruption, separate
self-propagating strain) — same entry path
(5) RESULT — data volumes destroyed; devices reboot into
first-run setup mode; user discovers empty NAS
timing: mass wave from 2021-06-23; some logs showed earlier
access dating back months (unnoticed recon/unauthorised use)Every stage was a known, named failure class: the vulnerability (command injection, unauthenticated) was a decade old; the exposure (internet-facing admin interface on a consumer device) violated the devices’ intended network position; and the lifecycle status (end-of-support, unpatchable) removed the last defensive option. The report WD published became required reading precisely because it tracked each stage so cleanly — the same per-stage accountability our infrastructure-exposure analysis applies to enterprise estates.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| Device line | WD My Book Live / Live Duo (discontinued, EOL firmware) | WD |
| Wave onset | 2021-06-23 (log evidence of earlier access) | WD report/forum |
| Primary CVE | CVE-2011-1802-class command injection (never patched) | advisories/WD |
| Actions executed | Factory reset/system-erase (WD-confirmed) + wiper corruption | WD forensics |
| Scale estimate | Tens of thousands of exposed units (internet-scan census of the era) | scan datasets |
| Vendor remediation | None possible on EOL line; guidance: disconnect devices | WD statements |
Timeline
| Date | Event |
|---|---|
| 2011–2015 | My Book Live ships; command-injection flaws documented; line EOLs without fixes |
| 2021-06-23 | Mass-wipe wave detected by users; forums light up |
| 2021-06-25 | WD acknowledges, urges disconnecting devices; investigation starts |
| 2021-07-09 | WD publishes forensic report: reset-command abuse + separate wiper |
| 2021–2022 | Class actions filed; incident canonised as EOL-IoT case study |
Why it still matters in 2026
The My Book Live wipe is the cleanest public demonstration that end-of-life devices with internet exposure don’t degrade gracefully — they convert, eventually, into guaranteed loss events. In 2026 the EOL-on-the-internet population is vastly larger: router fleets (the 2023–2025 mass-compromise waves of end-of-life Cisco/Netgear/Ubiquiti gear), NAS lines past support, camera systems, industrial gateways. The economics are unchanged: unpatchable RCE + visible admin surface + nobody watching = a resource (or amusement) for whoever finds it. Regulatory movement has followed — the EU Cyber Resilience Act’s support-duration requirements, security-baseline laws for connectable products, and disclosure duties all trace lineage to incidents like this one. For operators and individuals the practical rules stand: inventory what’s exposed (personal and organisational), check EOL status religiously, isolate legacy gear behind ACLs/VPN where retirement isn’t yet possible, and never let the backup device share fate with the backed-up network. The last rule is the one My Book Live users learned the hardest way — the device that exists to survive disasters became a disaster itself, a failure-mode we keep in view in resilience planning guidance.
Detection and hardening takeaways
- Inventory internet exposure continuously. For home and org: external attack-surface scans (Censys/Shodan-class self-lookup) naming every device with a public listener; anything you can’t explain gets removed from exposure — My Book victims’ first mistake was not knowing they were findable.
- Treat EOL as an incident deadline. When a vendor ends support, schedule retirement; if delayed, isolate (VLAN/ACL, VPN-only access) and monitor — an EOL device on the open internet is a when, not if.
- Never expose admin interfaces by default. NAS, router, camera config pages belong behind VPN or localhost-only bindings; UPnP should be disabled on home routers — it silently published thousands of My Book Lives.
- Follow the 3-2-1 rule — including for NAS. The backup box is also a computer: it needs an off-device copy (cloud or rotatable drive) so wiper-class events can’t take everything; single-device users were the wipe’s total-loss cohort.
- Watch device logs when they exist. My Book Live logs showed unauthorised access predating the wipe for some victims — anomalous-login alerts on any exposed gear buy retire-isolate-fix time.
FAQ
Was the My Book Live wipe ransomware?
Largely no. The dominant action was factory-reset/system-erase via command injection (no ransom asked, no decryption path offered), alongside a destructive self-propagating wiper on some units. Without extortion, there was nothing to negotiate — pure destruction, which is why recovery odds were effectively zero for users without separate backups.
Could Western Digital have fixed it?
Not meaningfully by June 2021 — the line was discontinued and unpatched for years by then; shipping a fix for EOL consumer kit (distribution, auto-update paths long dead) was impractical, which is exactly why the incident pushed lifecycle-policy conversations (mandatory support windows, coordinated EOL disclosures) into later regulation like the EU Cyber Resilience Act.
My old NAS/router is still behind a port-forward. What now?
Close the forward today, then decide: retire the device, or isolate it (LAN-only, VPN for remote access, no inbound rules). If data on it matters, copy it off first — assume any EOL device currently exposed is already compromised, and treat anything it has touched (credentials especially) as burned.
