DDoS Extortionists Demand Bitcoin from Email Providers

A number of privacy-oriented email service providers have been targeted by DDoS extortionists demanding payment in bitcoin.

AccessTimeIconNov 11, 2015 at 11:18 a.m. UTC
Updated Sep 11, 2021 at 11:59 a.m. UTC

A number of privacy-oriented email service providers have been targeted by distributed denial-of-service (DDoS) extortionists demanding payment in bitcoin.

Hushmail, ProtonMail and Runbox, among other services, were targeted by an entity calling itself the Armada Collective. The group was the subject of a warning from earlier this fall by the Swiss Governmental Computer Emergency Response Team, a national agency dedicated to cybersecurity issues.

Blog posts from the email providers indicate that the attacks took place between 3rd and 6th November. In the case of ProtonMail, the service paid the demanded ransom after being contacted on 3rd November, but despite the payment it was still targeted with DDoS attacks.

In a new blog post, ProtonMail said that it has "largely mitigated the DDoS attacks". Forbes reported yesterday that some of those funds have since been returned to ProtonMail’s bitcoin address, and that it believes the follow-up attacks may have been from a different party.

said that it experienced downtime on 5th and 6th November, and that it was refusing to pay the demanded payment. According to Runbox, an extortion demand was received on the 4th, with the downtime continuing through the 6th.

Affected email providers say they are working with law enforcement agencies, and at least one believes those behind it are starting to regret the action. ProtonMail founder Andy Yen told Forbes in an interview that the extortionists "know they are being hunted".

Image via Shutterstock


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.

Read more about