DDoS Extortionists Demand Bitcoin from Email Providers

A number of privacy-oriented email service providers have been targeted by DDoS extortionists demanding payment in bitcoin.

AccessTimeIconNov 11, 2015 at 11:18 a.m. UTC
Updated Sep 11, 2021 at 11:59 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

A number of privacy-oriented email service providers have been targeted by distributed denial-of-service (DDoS) extortionists demanding payment in bitcoin.

Hushmail, ProtonMail and Runbox, among other services, were targeted by an entity calling itself the Armada Collective. The group was the subject of a warning from earlier this fall by the Swiss Governmental Computer Emergency Response Team, a national agency dedicated to cybersecurity issues.

Blog posts from the email providers indicate that the attacks took place between 3rd and 6th November. In the case of ProtonMail, the service paid the demanded ransom after being contacted on 3rd November, but despite the payment it was still targeted with DDoS attacks.

In a new blog post, ProtonMail said that it has "largely mitigated the DDoS attacks". Forbes reported yesterday that some of those funds have since been returned to ProtonMail’s bitcoin address, and that it believes the follow-up attacks may have been from a different party.

said that it experienced downtime on 5th and 6th November, and that it was refusing to pay the demanded payment. According to Runbox, an extortion demand was received on the 4th, with the downtime continuing through the 6th.

Affected email providers say they are working with law enforcement agencies, and at least one believes those behind it are starting to regret the action. ProtonMail founder Andy Yen told Forbes in an interview that the extortionists "know they are being hunted".

Image via Shutterstock


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.

Read more about