Acquia has detected a temporary service interruption in DNS services impacting some Acquia sites and services
Incident Report for Acquia, Inc.
Postmortem

How the DDOS Attack on Dyn Affected Acquia

What happened

As has been widely reported, a major DDOS attack occurred last Friday, October 21, 2016 against the DNS provider, Dyn. This attack affected thousands of Internet services such as Github, Twitter, Spotify, Reddit, and Netflix, as well as Acquia. The attack began at approximately 11:10 UTC and had several "waves" where some services were affected until Dyn declared the incident resolved at 22:17 UTC. See Dyn's status incident report for more information on their response and mitigation.

How it affected Acquia and our customers

Acquia uses Dyn's services for DNS resolution on many of our domains. These included many of the sites that our customers use to manage their Acquia subscriptions as well as many back-end services such as our hosted Solr search servers.

At approximately 11:54 UTC, the effects of the DNS outage began to become apparent to our engineers and to our customers. As we realized that the scope of the problem was widespread, we began adding more status updates to keep our customers informed of our efforts to help our customers mitigate any effects these outages were having on their own sites.

With the resolution of the Dyn issue, we declared our services to be completely restored as of 23:37 UTC. However, we expect to make recommendations both internally and to our customers to help provide best practices to help weather these types of outages.

Future mitigation

We want to acknowledge the pain this incident caused our customers and we are working to make some changes to our internal configurations and management of DNS to allow us to continue to provide critical services during this type of outage when possible.

We also will be updating our documentation to make sure that customers are provided the best possible information on how to set their sites up to handle outages from upstream providers. A few customers were more affected than others depending on how DNS records are configured. Refer to our documented best practices to minimize exposure to DNS failures.

For our Enterprise customers, if you have any questions about the outage or would like to discuss specific points, please file a Support ticket or contact your Acquia Account Manager.

Posted Oct 25, 2016 - 14:32 UTC

Resolved
The interruption of service occurring as a result of an ongoing DDOS attack on Acquia's upstream DNS services provider is resolved. At this time, all Acquia services and sites have been restored and are operational.
Posted Oct 21, 2016 - 23:37 UTC
Update
We are continuing to monitor a service interruption currently occurring across some Acquia sites and services. This service interruption is due to an ongoing DDOS attack against our upstream DNS provider. We will provide additional information as it becomes available.
Posted Oct 21, 2016 - 21:47 UTC
Monitoring
We are continuing to monitor the service interruption currently occurring across some Acquia sites and services. This service interruption is due to an ongoing DDOS attack against our upstream DNS provider. We will provide additional information as it becomes available.
Posted Oct 21, 2016 - 20:36 UTC
Investigating
Customers with sites on Acquia Cloud Professional are also experiencing a service interruption at this time and are unable to launch new sites or upsize their existing sites. We will provide additional updates as they are available.
Posted Oct 21, 2016 - 19:39 UTC
Update
We are continuing to monitor the service interruption currently occurring across some Acquia sites and services. This service interruption is due to an ongoing DDOS attack against our upstream DNS provider. We will provide additional information as it becomes available.
Posted Oct 21, 2016 - 18:52 UTC
Monitoring
Acquia Search services for Acquia Cloud Professional and Acquia Cloud Enterprise sites are currently being impacted by the continuing service interruption our upstream DNS provider is experiencing due to an ongoing DDOS attack. We are continuing to monitor this service interruption and will provide additional information as it becomes available.
Posted Oct 21, 2016 - 18:09 UTC
Update
Customers with sites on Acquia Cloud Professional are also experiencing a service interruption at this time and are unable to launch new sites or upsize their existing sites. We will provide additional updates as they are available.
Posted Oct 21, 2016 - 17:20 UTC
Identified
Our upstream DNS provider is reporting a DDOS attack that is intermittently impacting their services. We are monitoring their progress as they attempt to resolve this attack. We will provide additional updates as they are available.
Posted Oct 21, 2016 - 17:07 UTC
Update
Acquia Cloud Site Factory sites are also impacted by this service interruption. Services for site management capabilities are currently unavailable. We are continuing to investigate this service interruption and will provide additional updates as they are available.
Posted Oct 21, 2016 - 16:53 UTC
Investigating
We are experiencing an interruption of service related to our upstream DNS provider impacting some Acquia sites and services, including:

* Acquia Insight Services
* Acquia Help Center, including the Acquia Support Ticketing system
* Acquia Cloud Network interface
* Acquia Lift
* Acquia Content Hub
* Acquia Cloud API
* Mollom

In the interim, please file tickets by calling the Acquia Support telephone number for your service region:

North and South America
888-922-7842 or +1 617-588-9600 #2

Australia, Japan, and Asia Pacific
+61 284 168 021

Europe and Africa
+44 1865 520 011

Services for Acquia Cloud Free sites are interrupted at this time. We will provide additional updates as they become available.
Posted Oct 21, 2016 - 16:47 UTC
This incident affected: Cloud Platform Enterprise, Cloud Platform Professional, Acquia Site Factory, Drupal Cloud UI, Acquia Support Systems, Drupal Cloud API, Acquia Search, Acquia Content Hub, and Acquia Personalization.