PROVIDENCE – Providence Business News’ website was down from approximately 6:30 p.m. Monday until 2 p.m. on Tuesday due to a massive cyber attack carried out by a hacker working under a Tunisian IP address.
“We now know that Tunisian vandals managed to hack into a mail server for one of our clients, and overrode or erased software and data on three critical servers,” said Bill Ostendorf, president of Creative Circle Media Consulting which services www.pbn.com. More than 200 of Creative Circle’s media sites were shut down by the attack.
The attack on Creative Circle servers began on Saturday night affecting a site in Utah, and returned Monday morning and again the same evening.
“In each round of attacks, we believed we had successfully blunted the attackers. However, we discovered a breach [Monday] night,” he said.
The utilities servers, handling e-mail and image storage, were primarily affected; data and software on two public-facing servers may also have been lost. The primary database servers, however, were not affected.
Creative Circle has identified the hacker as working from an IP address located in Tunisia; however IP addresses can be easily be redirected, said Ostendorf.
Nevertheless, if the IP address is from Tunisia, it may be related to the “Jasmine Revolution” ousting deposed President Zine el Abidine ben Ali, who fled to Saudi Arabia on Jan. 14.
“The theory is that hackers from Tunisia on both sides are looking for servers they can use to support their cause via spam and shielded e-mails,” said Ostendorf.
“We may never know if this is the case, especially before we have a chance to perform forensics on our hacked servers. But someone operating from anywhere could have faked the Tunisian IP as cover.”
