Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 83 posts

Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#1

Post by Koekoeksklok »

I've got a VPS which I use for small programming projects and college assignments. Two weeks ago I received an e-mail from my provider, stating that "your VPS has been transmitting a lot of outgoing traffic which results in a very large traffic usage bill". In September on my 500 GB data-limit VPS, it had been transmitting 27 TB of data traffic. This resulted in a € 3300 extra charge on my € 15 VPS. I'm expecting a similar bill for this month.

Of course I immediately shut down my VPS after the notice two weeks ago, but by then it had been using these amounts of traffic for a month and a half.

What are my options here? I can't afford to pay > € 5000 unfortunately. Does anyone have similar experiences?

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#4

Post by theonemind »

I work for a company that provides VPSes. In a situation like this, they can see the usage is aberrant and they can see it's not normal based on past bills. They'd likely offer a large credit if you say you didn't intend to do this, and it doesn't look like a fraudulent account. That being said, they themselves probably have bandwidth costs, and are not at all likely to forget all of the charge, perhaps half at best.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#6

Post by ColinCera »

Have you talked to your VPS provider? They should be able to cut you a break; after all, that 40TB of traffic cost them only a small fraction of what they're charging you, so if they're reasonable you should at least be able to get them to reduce the charges to their actual cost.

You might also offer to suggest writing up a post mortem for them, that they can provide to their customers as a lesson/tutorial on how to protect a VPS.

Finally, you can suggest that they might want to implement (and perhaps help them implement it) some kind of warning system, i.e., if a VPS suddenly begins using exorbitant amounts of bandwidth, and far more bandwidth than it ever has before, they really should email/text the owner an alert within 24 hours — not let it go on for 6 weeks. I'm surprised that they don't cap/throttle the bandwidth once you go over your plan's limit, to go along with sending you alerts. It borders on negligence on their part that they don't already have such a system in place.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#7

Post by minopret »

I can understand how that could happen and what a problem it would be. I had an experience with a telephone bill myself, but the story is not going to help you.

I would suppose your first and best resort is to consult your lawyer, advocate, solicitor, barrister, Anwalt. I wonder what your relevant legal jurisdiction is.

I wonder whether it would help if you can account for your own whereabouts and your own usage of endpoint data services. I wonder if your method of payment to your VPS provider is mediated by a financial service that can help you dispute the bill.

I am not a lawyer.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#8

Post by ishener »

I feel really sorry for you situation. I first suggest talking to the hosting provider and explain what happened. Any decent service will give some discount in this case.

Unfortunately, I can't think of anything else. I wish it was realistic to tell you to go to the police.

Also, if you would give your email, I would definitely consider sending a donation through paypal... Hopefully other readers here will do the same.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#9

Post by jnardiello »

I assume you are in europe. I'd suggest simply talking with your provider, explaining the issue and asking them to investigate. I honestly expect them to cooperate and be understanding.

If they insist for you to pay: simply don't. State the truth: You can't afford it. Tell them the only way they will see this money is by taking legal action against you and even in that case you won't be able to comply - as you don't have the money.

Hope it helps :(

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#10

Post by Blahah »

1. Report the incident to the police. Right now.

2. Report it to the VPS provider. Explain that you've reported it to the police. Ask for their cooperation in investigating the problem.

You do not have to pay. If they try to force you to pay, depending on your country, you'll probably end up in small claims court where you'll find judges are very reasonable people who usually side with the little guy. (IANAL)

Post reply on HN