How the Code Spaces hack happened: one cloud login deleted a company in 12 hours

In June 2014, a code-hosting company that advertised full redundancy and real-time backups to multiple off-site locations went out of business in about 12 hours.^[1][2] This case file covers how one stolen cloud login let an extortionist delete the company's servers and its backups together, and the control that would have kept the key out of his hands.

What happened

How they got in

The company did not publicly explain how the attacker got its control panel login.^[1] What is clear is what that login could do. One account had the power to create new users, to run and remove servers, and to delete every copy of the data, including the ones the company thought of as backups.^[1]

That is the core problem. Code Spaces' backups were real, and they were in more than one place, but all of them could be reached and erased from the same cloud account. To the attacker, the backups were just more things to delete.^[1][2]

How it was caught

This attack announced itself. The attacker wanted to be paid, so he made sure the company knew he was inside.^[1] The problem was not detection but what came after. Changing passwords did not remove the extra logins the intruder had already set up, so the company's attempt to lock him out only prompted him to act.^[1]

Security specialists quoted after the attack said it showed the need for stronger sign-in than passwords alone for cloud control panels, frequent rotation of access keys, and monitoring that flags unexpected changes such as new accounts being created.^[2]

What it cost

Everything. Within about 12 hours of the first attack, the company said it had lost most of its data and could not continue.^[1][2] The loss was financial and also a matter of trust: a business that sold safe storage could not survive losing its customers' code.^[2] Customers who had relied on Code Spaces as their only copy of their work lost that too.

The missing control

The missing control: multi-factor authentication on the cloud admin console, backed by backups that the same admin login cannot delete.

With a second sign-in step, such as a code from a phone app or a hardware key, a stolen password alone would not have opened the control panel. And if the backups had lived in a separate account, or in storage set up so that copies cannot be erased for a set time, the attacker could have caused a bad day instead of ending the company. The redundancy Code Spaces advertised was real for hardware failures. It offered no protection against one person with the master key.

What to do in your business

• Put two-factor on every admin login. Your cloud accounts, website host, domain registrar and Microsoft 365 or Google Workspace admin accounts should all require a second step at sign-in.
• Keep one backup out of reach. Store at least one copy of your important data somewhere your everyday admin login cannot delete, such as a separate account, locked storage or an offline drive.
• Test a restore. Once a quarter, bring back a real file or system from backup. A backup you have never restored is a hope, not a plan.
• Get alerts on new accounts. Turn on notices for new admin users, new access keys and mass deletions, so a hidden back door shows up quickly.
• Plan the lockout. Write down who to call at your cloud provider and how to disable every login at once, not just change one password.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.