If you hadn't heard about it, VFEMail may be dead. At least, that's what the founder was thinking in this article. A malicious hacking incident took place last week, and though they're back up and running, who knows if customers will stick by them, or maybe sue them out of existence. I wouldn't be surprised as a large number of their infrastructure servers were wiped out by reformatting servers. These included mail servers, backup servers, and SQL Servers.

That's quite an attack, and whether this was directed at the company or some individuals, a large number of people might have lost their mailboxes and previously stored mail that was in IMAP storage. This is the type of issue that is most likely an annoyance for individuals, but it would be potentially catastrophic for businesses. Imagine your small business hosted with them and all your mailboxes were lost with customer communications and who knows what else. Perhaps you could recover data or keep the business going, but it might be an issue.

Could this happen with a cloud provider like Azure O365, Google Apps or AWS? Possibly, and while I'm sure they have backups, I'm not sure how reliable those might be for the average individual or small business. This makes me worry slightly as I depend on GMail and wouldn't even try to backup to few 100GBs of mail I have. I'm not even sure how to do it, though I don't really keep anything in there that's really important. In any case, I'd suspect that connecting and somehow wiping out Gmail servers, along with backups, would be very difficult.

This does make me think about a few customers I know that use online storage for backups. They assume that they will always have either a primary server or the online backup server/share/bucket/container and can download data. The problem is that online systems that connect to the primary can be accessed. If an attacker were to access one, they potentially could access the second.

The world seems to be moving towards more online storage, or in the case of cloud vendors, a reliance on snapshots. That might be good enough for cloud vendors, but it's certainly not for any on-premise system. It's likely that an attacker, possibly with insider help, would wipe out backups first, then primary systems. I'd always want some sort of disconnected offline backup of data, especially database servers. I have seen Murphy's Law strike two systems at once, so an air gap between copies of data just feels prudent.