Yesterday, PG posted about a severe computer outage at Barnes & Noble that reportedly took down the system Barnes & Noble’s physical stores use for orders, inventory control, etc., as well as the Nook store and the ability of Nook users to synchronize their devices, access ebooks not already stored on their Nooks, etc.
This problem took Barnes & Noble about three days from the first report PG read to fix the problem.
To the best of PG’s current knowledge, only two websites, GoodEreader (October 10) and The Digital Reader (October 13), reported on the outage.
Ergo, the entire Nook system went down and nobody noticed.
PG suspects if Amazon’s ebook store went offline went offline for an hour or two, let alone for three days, the Wall Street Journal, New York Times and major US television networks would all cover the story.
PG suggests that this is perhaps the best evidence yet that the Nook ereader and Nook’s ebookstore don’t matter any more. Perhaps they’re not dead (at least today), but are semi-comatose.
At least in North America, it appears that Kobo may be #2 behind the Zon.
Barnes & Noble CEO James Daunt, the hope for traditional publishing’s future in the US, has, to the best of PG’s knowledge, had nothing to say about the ebook disaster (and physical bookstore ordering, etc., disaster) that appears to have been occurring in the US company for which he is the CEO.
If PG has missed something that Daunt or Barnes & Noble PR department has said about this matter, he would be happy to hear about it via the Contact link for The Passive Voice.
It was all over REDDIT since saturday and Publisher’s Lunch had it Oct 13:
https://lunch.publishersmarketplace.com/2020/10/barnes-noble-says-most-systems-are-back-online-after-major-multi-day-outage-but-nook-is-still-being-restored/
It claimed the crash was “mostly” fixed by then.
As in “the store cash registers are back up, even if BN.COM and Nook aren’t”.
Shows what tbeir priorities are.
According to the comments at the Digital Reader blog by nook customers, they are still locked out late wednesday. The natives are getting restless. And shrill.
Daunt didn’t need this.
Hey, somebody finally noticed: in the UK.
https://www.theregister.com/2020/10/15/nook_barnes_noble_hacked/
And B&N finally admitted openly it was hacked by sending out emails to some customers.
There is speculation it was a ransomware attack, which might explain why it took so long to address and why Nook is still down.
—-
B&N has yet to confirm any details of the ongoing network collapse – which has spanned at least three days now – though it is whispered that malware may have taken hold of the bookseller’s machines and spread to stores and the Nook cloud. The company told The Register it has “a network issue and are in the process of restoring our server backups,” which sounds like a ransomware attack.
The book flogger also said it is “investigating the cause,” though stressed there has been “no compromise of customer payment details which are encrypted and tokenized.”
That feels like a carefully worded statement and leaves open the possibility other customer records may have been compromised or meddled with – such as usernames, passwords, and contact details – but that payment information was protected.
Pressed for more detail on whether malware was responsible or whether user data had been compromised, a Barnes & Noble representative noted only that it was “working urgently to get Nook repaired,” and was investigating.
The length of time that the network has been down and the lack of communication from the company points to a more serious problem than a simple network failure. Initially the biz said the system would be back up within a few hours of the first reports of problems.
On Tuesday, some parts of the network reappeared, with cash registers and the BN.com website largely back up on Wednesday, although some webpages still showed problems and the Nook e-book system has been up and down all day, and at the time of writing is still suffering problems.
It wasn’t until Wednesday afternoon that a notice finally appeared on the Nook site announcing: “We’re very sorry – NOOK Books are currently unavailable due to a system issue. We’ll have this fixed as soon as we can.”
—-
Six days and counting…
Details are finally emerging.
ZDNET is reporting:
“As noted by The Register, the outage also spread to physical outlets, where it appeared that some cash registers were also “briefly” unable to function.
This prompted speculation that the disruption could be due to a malware infection, as when Point-of-Sale (PoS) systems become involved, the issue may not merely be due to a backend or server glitch. ”
“While the details of the cyberattack are yet to be made public, it is possible that ransomware could be at the heart of the incident. Bad Packets told BleepingComputer that the bookseller’s VPN servers were previously vulnerable to CVE-2019-11510, an arbitrary read vulnerability.
Security flaws like this can be used to compromise corporate networks and deploy payloads, including ransomware. In recent months, AG and the Duesseldorf University Hospital have experienced severe ransomware attacks. ”
https://www.zdnet.com/article/barnes-noble-confirms-cyberattack-customer-data-breach/
That’s a known vulnerability since 2019.
If it’s ransomware the attackers picked a dubious target. B&N may not consider Nook worth paying to restore. 😀
BTW, this is the most media attention Nook has received in years.
The Bleeping News report is more of the same except it adds this ominous bit:
“Unfortunately, if they did suffer a ransomware attack, it is likely that much more data was exposed than Barnes & Noble is disclosing.
When ransomware operators attack a network, they first steal unencrypted files to use as leverage to get a victim to pay the ransom. If the victim refuses to pay, the ransomware gang leaks the unencrypted data on data leak sites.
These leaked files can have personal employee information, including passports, drivers licenses, medical information, and salary. ”
https://www.bleepingcomputer.com/news/security/barnes-and-noble-hit-by-cyberattack-that-exposed-customer-data/
That is for hospitals and government agencies.
With retailers what gets exposed is often customer credit card info.
“Finally, cybersecurity intelligence firm Bad Packets told BleepingComputer that Barnes & Noble perviously had multiple Pulse VPN servers that were vulnerable to the CVE-2019-11510 vulnerability.
This vulnerability is popular among ransomware threat actors as it allows them to gain access to user credentials stored on the VPN device. ”
The snowball rolls on.
So they restore already compromised user credentials. Um…
Remediating these sorts of attacks takes specialized knowledge, often hired from outside the company in panic mode.
Large companies that depend on their digital infrastructure hold the equivalent of digital fire drills, where they simulate problems on a parallel network and then solve them and evaluate the effort.
As PG says, I would be very interested in hearing Daunt’s take on this.
Yeah, it would be interesting to see who chose not to patch an 18 month old vulnerability and who chose not to inform and reassure Nook customers until the fifth day.
Also, did Daunt know of the hack and sanction the silence?
Or did middle management mushroom patch him, too.
That has happened to other CEOs, notably Howard Stringer at Sony.