British NHS DDOS attacks itself via email sent to 1.2M staff

http://www.telegraph.co.uk/news/2016/11/14/nhs-it-blunder-sees-system-clogged-after-email-sent-to-12-millio/

by stuartbman • 10 years ago

26 12 10 years ago

telegraph.co.uk

misframer• 10 years ago

Reminds me of the "Bedlam DL3" story from Microsoft [0].

[0] https://blogs.technet.microsoft.com/exchange/2004/04/08/me-t...

0xmohit• 10 years ago

Somewhat odd that in setups this large emails to all are unregulated. I'd expect those to go through some "approval" channel.

astrodust2• 10 years ago

Can anyone explain why people leave their servers configured to allow arbitrarily long To: lists? Any large organization is just one mistake away from a Reply-All apocalypse.

Shanea93• 10 years ago

At the very least, the operations accounts, security, newsletters and Simon Stevens himself should have the ability to send a network-wide email - outside of that there's no good reason for Johnny intern to be sending an email to that many people.

bcraven• 10 years ago

This may be a mailing list, rather than a simple 'Reply-All' thing (and the media have misunderstood). The reply box will be a single address if that's the case.

astrodust2• 10 years ago

If so, there's ways of limiting who can address that address and in so doing spam the entire company.

ljf• 10 years ago

Dupe: https://news.ycombinator.com/item?id=12950830

rcarmo• 10 years ago

This is reminiscent of at least one IT Crowd episode (I forget the title), and so typical...

eggie5• 10 years ago

This happened at Qualcomm once. Some IT email was sent out to most of the corp and then people's vacation/out-of-office auto-reply-to-all propagated it more. Then people would send reply-all messages like "remove me from this list!" it went on for most of the day.

dudus• 10 years ago

Also happened at IBM when I worked there. A guy named Armando changed his phone and manage to send a notice to everyone in the company using a maillist. People didn't know about the maillist and started to ask to be removed, turns out it was not possible... It took weeks to solve and everyone at IBM pretty much lost access to email during the period due to the overload. Even worse, at the time a lot of internal systems at IBM were based in Lotus Notes that is a weird framework email client mashup and those systems were also affected.

This happened in 2007

mhays• 10 years ago

This is not a ddos attack. More like ddos mistake or accident.

johansch• 10 years ago

Two stories about this topic on the front-page right now. Merge them?

British NHS DDOS attacks itself via email sent to 1.2M staff

Related Stories