Rackspace let a known Exchange bug take down its hosted email for thousands of customers

On 6 December 2022 Rackspace Technology announced a ransomware attack on its Hosted Exchange environment, knocking out email for thousands of customers, most of them small and mid-sized businesses. The company said the incident was isolated to Hosted Exchange and that its other products were unaffected.

The intrusion was not exotic. Rackspace ultimately blamed the Play ransomware crew, who got in by exploiting CVE-2022-41080, a critical Microsoft Exchange privilege-escalation bug, before Microsoft shipped a fix. A single known, pre-disclosed vulnerability against a legacy hosted-email product took an entire product line offline.

The bill was large for a product the company was already winding down. Rackspace racked up about $11 million in ransomware-related expenses, roughly half covered by insurance, and the Hosted Exchange business it was sunsetting generated around $30 million a year in revenue it now risked losing. The outage also drew lawsuits over the service disruption.

The case is a decision about what a company chooses to keep running. Rackspace was phasing Hosted Exchange out, yet the platform still held thousands of paying customers and sat exposed to a bug that had already been disclosed publicly. The cost of retiring a product is not just migration — it is hardening the legacy service until the last customer leaves.