Is this problem also related to other NAS in WD’s product line? I have just ordered a WD My Cloud EX2…
Right now I wouldn’t trust any WD NAS until there is verification that it is safe.
One thing I need to find out is if these drives send telemetry to WD in the background. I’m betting that they do. If that’s the case then I would look very sharply at the idea that this could have originated from compromised WD servers.
I’m just struggling to figure out how all these specific drives were being injected with SSL scripts worldwide and it all happening very rapidly, within a space of a few hours. That leads me to suspect that whatever the source was of this attack, it must have already had existing access to these drives since the IP addresses were needed to execute that script.
I find it very concerning to read that some users are reporting that they were hit by this while they had remote features disabled. Although I have a different device, I’m keeping it fully disconnected until we know more
Yep same here. In Australia. Happened exactly at 7.10am on Thursday morning Western Australia Time. I was actually watching it go from blue to yellow led. Was odd so logged in and found it reset.
No idea why but too to a mates and all that he had was rphoto. All the data is there but no file or folder names so that was hard to use given there’s 1000`s of files
Have taken to a pro who’s looking at it now with R studio and he said he’s found superblocks…
Then I saw this just now I’m not the only one! I thought it was me.
I did see logs on my virus firewall showing an increase in attacks in the last few days on that device but didn’t do anything. Was going to disconnect remote access but then this happened before I got the chance.
Pissed but my bad with only backups of partial docs and photos items but lost all my iTunes library and video library.
Feel stupid but definitely expect more from WD.
Is it even worth opening a support ticket？ the unit is 9 years old
■■■■: EX2Ultra - and also all data gone!
Just had a look at my firewall logs. Nothing since the 1st of April until the early hours of this morning. Since then it has blocked dozens of remote administration attempts. Not sure if this is in any way related but it’s a bit of a worrying coincidence.
I never liked how slow NAS was, how frequently it looses connectivity and had to be reset multiple times but THIS?! WD has a major issue with this “factory reset” and downplays the event limiting it to some unlucky customers. But it looks more and more as massive “Carrington Event” for WD My Cloud users. Very upset, I don’t expect WD to do anything meaningful to resolve this issue. Now I have to rethink the entire strategy of backups, NAS, cloud services etc. The world we all live in is full of nastiness and unreliability. “Thanks”, WD for adding more chaos to our life.
same here - all gone - as of this morning june 25th. just default public folders and software and cant login to the UI to erase and reconfigure
Same thing happened to me overnight 23rd /24th June 2021.
Been scratching my head trying to work out what or who had deleted everything. I’d seen the windows 10 references, and noted the date, but had the same problem on smart TV’s so rightly assumed that windows 10 not the problem especially as all had been working fine the day before.
Everything from admin rights to data has disappeared leaving me with what looks like a new device and no option to rewind the clock.
Been running the 2Tb version for several years to across all household devices to support and provide what we thought was a secure RAID back up system with no problems.
I would still report and open a ticket just to continue to raise the issue up the agenda. I don’t expect any meaningful resolution from them but I will keep bombarding them until I feel like they’re sorry even if it takes 10 years off my life! You’re not alone in feeling stupid, I have so many regrets right now!
Attempt to recover using Stellar Data Recovery was unsuccessful, it found nothing after a full scan. Will look at other methods this evening.
Have made some progress in recovering files…
Removed disk from enclosure
Used a Sata to USB adapter into my Win 10 laptop
Installed Ext2Fsd and mounted the drive
Installed TestDisk and have run photo_rec against the whole disk.
Recovering the files slowly, mostly jpg and mov, not sure how it’ll do with other docs but have seen some non media files coming across.
This is good news. I just dropped mine off with a local shop in hopes that they can recover the data, I figured it was safer than trying it myself! So hopefully they’ll have success.
Same has happened to me.
Luckily, I had my most important files backed up on an external 4TB passport drive.
Let us know how you get on. I’ve just shipped mine to a no-recovery-no fee type arrangement.
Sorry to hear that @Grokheim. Hopefully you’ll have more luck with another option.
Mine has been shut down by ME. I didn’t have any issues, just trying to avoid one until I see WD has done something about this. BUT just to let everyone know I had auto updates OFF and no cloud services enabled. Worst case scenario for me would be nothing gets fixed by WD and I pull the 3TB red for a backup to my other NAS drives in the event of a drive failure. I have nothing on mine of any value, fortunately.
Yes, they had the same deal as well. If they can’t recover the data, there’s no charge. And they’re local so I was able to drop it right off. Hopefully I’ll hear something back today.
Fortunately there wasn’t a ton of data on the drive (only about 8 gigs), and it was mostly word/excel/pdf docs. So I’m hopeful if they can recover it, it won’t take too long. I will for sure keep you posted!