Video Q&A from 5/11 (during outage)
On May 9, 2022, HawkSoft learned from our hosting partner that one of their data centers for HawkSoft Online was inflicted with a ransomware attack.
A ransomware attack is where an outside entity injects malware that encrypts information and holds it hostage to a monetary ransom amount. The Cybersecurity and Infrastructure Security Agency (CISA) of the United States government has issued an advisory about cybercriminal attack techniques after a surge of "sophisticated, high impact" ransomware attacks on businesses and organizations. HawkSoft Online service has been disrupted for all agencies hosted at this data center.
HawkSoft Online service was disrupted for all agencies hosted at the impacted data center, which accounts for 14% of the HawkSoft customer base. Currently, there is no indication that personal identifiable information (PII) has been stolen. In addition, other clients (outside of HawkSoft) that are hosting data with our hosting partner on the impacted data center were also affected. Access to HawkSoft Online was restored for all customers by May 13, 2022 at 3:20am PST.
During times of connectivity difficulty for HawkSoft Online, Agent Portal may be a helpful tool for your agency. Agent Portal allows you to view client and policy information from a web browser and is not usually impacted by issues on HawkSoft Online, as it accesses data through HawkSoft’s cloud servers.
If your agency has already enabled Agent Portal, you can access it here using the username [HawkSoft Initials]@[AgencyID] and your HawkSoft password.
If you have not yet enabled Agent Portal, see these instructions for enabling Agent Portal for your agency. Data Sync must be enabled in order to set up Agent Portal, and because it is not possible to enable Data Sync during an outage, we strongly encourage you to enable Data Sync now to be prepared and able to access your data during service interruptions.
Communications are listed with most recent communications first. You may need to refresh this page in order to see the most recent updates. Due to the sensitive nature of this issue, full email content may not be listed here. If you or someone at your agency needs to be added to the list to receive these emails, please contact marketing@hawksoft.com.
A message was sent to all impacted agencies regarding the service credit they will receive for the outage. This will likely be the final communication on the incident, unless any further information comes to our attention in future.
The email provided a summary of the incident, response, and measures put in place to mitigate future incidents. It also linked to an FAQ page regarding the event, which addresses many questions about ransomware events in general as well as this specific incident. See details in email. We ask that you please read this provided information and FAQ before contacting us with questions about the incident.
The email did not contain information about potential service credits. While we know no amount of credit can truly make up for the negative impact of the outage on your agency, we are currently working with our hosting partner on this issue and will send a separate communication regarding this to affected customers in the coming weeks.
We have now received the formal security report and root cause forensics analysis (RCA) for the incident from our online hosting partner. We are currently in the process of working through our questions from the report with our hosting partner, confirming what we can communicate without compromising future security, and compiling an incident summary and FAQ. We expect that this process will still take some time, but we will share the additional materials with you as soon as possible in the coming weeks.
Our partner has taken a thorough approach to analyze the actions that resulted in the attack and has taken necessary steps to protect their customer IT environments. They have built in additional strategies to further increase durability, distribution, and ability to withstand the most aggressive challenges, including cybersecurity threats and disruptions.
The cybersecurity team engaged by our hosting partner is still in the process of compiling the formal security report and root cause forensics analysis (RCA) for the incident. Once the RCA has been provided to us and our hosting partner, we can share further details with our customers regarding the incident and the steps being taken to prevent similar events in the future. As stated earlier, we may be limited in the amount of detail we are able to provide due to the sensitive nature of the incident and to ensure other malicious actors cannot reverse engineer a strategy based on data that we share.
Our process for outages is to review the incident’s impact on customers and whether it may potentially merit credits to affected agencies after we have received the RCA and understand the full scope of the incident.
Access to the affected servers has been restored and IVANS Downloads are now running again. If you have any problems connecting to or using the HawkSoft Online environment, please contact Support immediately (1-866-884-4680, Option 3). Please remember to identify yourself as an agency that was affected by the outage.
Our hosting partner and HawkSoft has restored access to the affected servers. We are happy to announce that all systems are back online except for IVANS Downloads. We continue to work on this component, which will mean your current downloads will not be available at this time. Your connection settings should work as configured. No change or update is necessary. If you have any problems connecting to or using the HawkSoft Online environment, please contact support immediately (1-866-884-4680, Option 3). Please remember to identify yourself as an agency that was affected by the outage.
The final infrastructure work being performed by our hosting partner has taken longer than expected, but we anticipate it will be finished within a few hours, and testing by both HawkSoft and our hosting partner will commence tonight. Our hosting partner has teams working 24/7 and will restore access as quickly as possible without compromising the security and integrity of the environment.
Our hosting partner is nearing completion of restoring access to the affected servers and finalizing the needed infrastructure. We are continuing to perform extensive testing and still feel confident that HawkSoft Online will be restored tonight. While we cannot provide an exact ETA, we will send a notification later tonight when we have received confirmation that the restoration and testing are complete and all affected agencies can access their data.
Our hosting partner continues to make significant progress on restoring access to the affected servers and they are in the process of finalizing the needed infrastructure. As stated earlier, we still remain optimistic about restoring access to HawkSoft Online today, but as the situation remains fluid we cannot commit to an ETA. HawkSoft will perform rigorous testing on the environment on our end to ensure that everything is in place to restore access to agencies.
Our hosting partner once again worked throughout the night on the process of restoring access to the affected servers, and that process is now nearing completion. Following this, HawkSoft will also perform rigorous testing on the environment on our end to ensure that everything is in place to restore access to agencies. While we are optimistic about restoring access to HawkSoft Online to agencies today, we cannot yet commit to a firm ETA.
We are happy to report that significant progress has been made and we feel we are rounding third base. Our hosting partner will once again continue to work through the night to do all they can to get our agencies back online while ensuring the utmost safety and security of data and the environment.
A personal message from our executive team was recorded to provide deeper insight on the information we are allowed to share. The video is posted above. Please see the most recent email for further details.
Our hosting partner is continuing to diligently work on the process of restoring access to the affected servers. At this time, we still do not have an ETA yet of when access will be restored, but all resources are being dedicated to this situation. The process is being done in the fastest way possible while ensuring the utmost safety and security of data and the environment. See further details in email.
We appreciate and understand the questions and concerns that have been expressed about this situation. Our executive team hears you and is recording a personal message that will hopefully shed a little more light on the nature of what has happened. HawkSoft understands that this event is very frustrating. We hope to lean on your kindness and understanding that due to the nature of the attack, we are only permitted to reveal certain information at this time. We hope to make this message available to you later today.
Great news! We are encouraged to report that an important milestone has been reached and our hosting partner has begun the process of restoring access to the affected servers. The process is being done in the fastest way possible while ensuring the utmost safety and security of data and the environment. See further details in email.
We want to assure you that progress has been made today, and that our teams have worked tirelessly yesterday, last night, and today on this issue. They will continue to work throughout the night, and we will provide another update as soon as possible tomorrow morning. See further details in email.
No further updates at this time. While our partner has additional details about the efforts being made to restore access, due to security concerns and the ongoing fluidity of the situation, we unfortunately cannot share further details at this time. Doing so may compromise those efforts. See further details in email.
No further updates at this time. While our partner has additional details about the efforts being made to restore access, due to security concerns and the ongoing fluidity of the situation, we unfortunately cannot share further details at this time. Doing so may compromise those efforts. See further details in email.
Our hosting partner continues to work around the clock to build additional infrastructure and restore access to key systems. While they currently do not believe access will be restored today, progress is being made and they will continue to update us throughout the day as the situation develops. See further details in email.
Our hosting partner worked throughout the night and continues to work around the clock to restore access to key systems. They currently do not believe access will be restored today, but are in constant communication with us and will update us as the situation develops. Email updates will continue to be sent every two hours today. See further details in email.
No new information is available at this time. As previously mentioned, connectivity will not be restored today. The situation is still fluid. The hosting partner does not have a confirmed ETA on a resolution. They were previously targeting Tuesday morning, but with current information, they cannot make that commitment. The hosting partner has confirmed that HawkSoft agencies will be the first ones queued to be restored as soon as connectivity is reestablished. Please keep monitoring this webpage for the latest information.
This is the last email update for today, Monday. If there are any important updates tonight, we will email you as soon as possible. If there are no updates tonight, you will receive an update email on Tuesday morning by 6:30am PT at the latest.
While many agencies were able to access read-only client information today using Agent Portal, we recognize that today may have been a lost day for agencies that could not. If you are unable to access Agent Portal, please contact Support for help on how to do so.
Thank you again for your continuing patience while we work to resolve this issue.
During this service disruption, many agencies can use Agent Portal to view client and policy information from a web browser. See more info here.
We have learned that connectivity will not be restored today before the end of the business day. The hosting partner is targeting a resolution by Tuesday morning, but the situation is still fluid. Please keep monitoring this webpage for the latest information.
We’ll send one more update email before the end of business day today. Thank you for your patience while we work to resolve this issue.
HawkSoft recognizes that this situation has a great impact on you, your agency, your staff, and your clients. Any amount of downtime is regrettable to HawkSoft. We have all hands on deck working to resolve this issue and communicate updates with you.
We have been able to confirm from our hosting partners that currently, there is no indication that personal identifiable information (PII) data has been stolen. We continue working with our hosting partners towards a safe and reliable solution to the ransomware attack. Please keep monitoring this webpage for the latest information.
During this service disruption, many agencies can use Agent Portal to view client and policy information from a web browser. See more info on this here.
We’ll send another update email in two hours. Thank you for your patience while we work to resolve this issue.
HawkSoft recognizes that this situation has a great impact on you, your agency, your staff, and your clients. Any amount of downtime is regrettable to HawkSoft. We have all hands on deck working to resolve this issue and communicate updates with you.
We are in contact with our hosting partners every hour and continue to work towards a safe and reliable solution to the ransomware attack. At this time we have no new information to provide. Please keep monitoring this webpage for the latest information.
During this service disruption, many agencies can use Agent Portal to view client and policy information from a web browser. See more info here.
We’ll send another update email in two hours. Thank you for your patience while we work to resolve this issue.
We’d like to bring you updates about the service disruption as we learn of them from our hosting partner. We will use email and our support website to communicate all messages. We will also log all communications related to this service disruption on this webpage.
HawkSoft has learned from our hosting partner that they have been inflicted with a ransomware attack. A ransomware attack is where an outside entity injects malware that encrypts information and holds it hostage to a monetary ransom amount. The Cybersecurity and Infrastructure Security Agency (CISA) of the United States government has issued an advisory about cybercriminal attack techniques after a surge of "sophisticated, high impact" ransomware attacks on businesses and organizations.
HawkSoft Online service has been disrupted for all agencies hosted at this data center. In addition, other clients (outside of HawkSoft) that are hosting data with our hosting partner at their data center are also affected. We are working with our hosting partner to determine the fastest and most secure way to get all agencies working again.
During times of connectivity difficulty for HawkSoft Online, Agent Portal may be a helpful tool for your agency. Agent Portal allows you to view client and policy information from a web browser and is not usually impacted by issues on HawkSoft Online, as it accesses data through HawkSoft’s cloud servers.
If your agency has already enabled Agent Portal, you can access it here using the username [HawkSoft Initials]@[AgencyID] and your HawkSoft password.
If you have enabled Data Sync but have not yet enabled Agent Portal, see these instructions for enabling Agent Portal for your agency.
If your agency has not enabled Data Sync, you will be able to access your data once our hosting partner has resolved the ransomware attack.
HawkSoft recognizes that this situation has a great impact on you, your agency, your staff, and your clients. Any amount of downtime is regrettable to HawkSoft. Our online hosting partner is working to resolve the issue as soon as possible and optimize your HawkSoft Online experience.
If the situation is not resolved within the next two hours, we will send another update email at that time. Our Support page will be kept updated with the most current updates on the situation.
Thank you for your patience while we work to resolve this issue.
HawkSoft is aware of an issue impacting access to and use of HawkSoft Online. HawkSoft is in active communication with the impacted hosting partner. Our hosting partner is working to resolve the root cause of this issue.
HawkSoft recognizes that this situation has a great impact on you, your agency, your staff, and your clients. Any amount of downtime is regrettable to HawkSoft. Our online hosting partner is working to resolve the issue as soon as possible and optimize your HawkSoft Online experience.
If the situation is not resolved within the next two hours, we will send another update email at that time. Our Support page will be kept updated with the most current updates on the situation.
Thank you for your patience while we work to resolve this issue.
During times of connectivity difficulty for HawkSoft Online, Agent Portal may be a helpful tool for your agency. Agent Portal allows you to view client and policy information from a web browser and is not usually impacted by issues on HawkSoft Online, as it accesses data through HawkSoft’s cloud servers.
If your agency has already enabled Agent Portal, you can access it here using the username [HawkSoft Initials]@[AgencyID] and your HawkSoft password. If you have not yet enabled Agent Portal, see these instructions for enabling it for your agency.
"I had 3 systems in house at one time to compare. HawkSoft is incomparably good when you call for help. The functionality is good and it is always getting better. We've merged 3 agencies together and have decades of experience with all 3 of these systems. When it was time to choose, HawkSoft was the over whelming choice hands down."
Don L.
"I have been using HawkSoft since 2008 for the agency I work with. System was fantastic to start with even in 2008, but it kept evolving every year with new features and turned into THE BEST system I ever came across. It has all the bells and whistles one could wish for."
Sagar R.
Since 1995, HawkSoft is a leader in management systems for agencies that want effective workflows and a delightful experience for staff and policyholders. We take pride in being independently owned and answerable to agencies that rely on our system to power their insurance business. Created by independent agents, HawkSoft continues to evolve as a cutting-edge system that powers thousands of agencies. Read More