Western Digital identified a network security incident on 26 March 2023 in which an unauthorised party accessed a number of company systems. It disclosed the incident on 2 April and took cloud services offline, including My Cloud, My Cloud Home, SanDisk ibi and related products. Service was restored on 13 April.
The company later confirmed that an unauthorised party obtained a copy of a database used for its online store, containing customer names, billing and shipping addresses, email addresses and telephone numbers.
Containment Was The Outage
Nothing encrypted the customer files. The eleven days of unavailability were a decision — the company took services down to contain an intrusion it did not yet understand.
The corpus records deliberate shutdown as a containment choice at 25-0802 for Saint Paul and 26-0507 for West Pharmaceutical, and argues each time that it is the option that looks worst and is frequently correct. It is also the one that guarantees the harm lands on customers rather than staying with the company.
A Product Category That Promises Availability
Personal cloud storage is sold on a specific promise: your files, reachable. An outage is not a degraded experience for that product — it is the product not existing for eleven days.
The corpus makes the same observation about security appliances at 23-0518 and 26-0705, and about digital-only banking at 26-0124. Where the promise is the thing that fails, the failure is categorically worse than the same downtime elsewhere.
The Ten-Terabyte Figure Is A Claim
People claiming responsibility told reporters they had taken around ten terabytes, including internal communications and information on executives and customers. That figure originates with the people doing the extorting and this desk does not carry it in the record.
What is recorded is what the company confirmed: the online store database and its field list.
Built on Western Digital’s own update on the network security incident and on contemporaneous reporting of the disclosure and outage. The 26 March identification, the service restoration on 13 April and the store database field list are the company’s. The ten-terabyte figure and the description of what else was taken come from people claiming responsibility, speaking to reporters; both appear in the body labelled as claims and neither is in the record. No actor attribution is made. Graded high on the intrusion, the outage and the confirmed database. Corrections: corrections@forensicpost.com.
- Western Digital Provides Update on Network Security IncidentWestern Digital
- Western Digital discloses network breach, My Cloud service downBleepingComputer