Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 81 posts

Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#1

Post by frogcoder »

Usually our monthly fee won't exceed 1,000 dollars. We discovered last month's bill is almost 3,000, and for this month up till now it's already over 200,000.

We collected the evidences and filed police report. The bill is paid through a distributor, anything we ask about the reduction of payment, the distributor just passes it on to Microsoft. I feel if we don't find a way to talk to Microsoft, we will just end up paying the whole thing.

Many of you might think we screwed up, we pay up, but I think it's more like a stolen credit card situation, we can negotiate with the bank. How do I go about this?

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#4

Post by nwiswell »

Step 1: Read your cloud services contract with Microsoft very carefully. What does it say about your liability for fraud?

Step 2: Read your business insurance policy very carefully. What does it say about fraud coverage? What are the limits and exclusions?

Step 3: Unless 1 or 2 makes it real clear the business is not liable, get a lawyer.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#6

Post by akerl_ »

nwiswell wrote: post #4

Step 1: Read your cloud services contract with Microsoft very carefully. What does it say about your liability for fraud? Step 2: Read your business insurance policy very carefully. What does it say about fraud coverage? What are the limits and exclusions? Step 3: Unless 1 or 2 makes it real clear the business is not liable, get a lawyer.

Business insurance? That doesn’t sound like part of a minimum viable product.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#7

Post by [deleted] »

akerl_ wrote: post #6
nwiswell wrote: post #4

Step 1: Read your cloud services contract with Microsoft very carefully. What does it say about your liability for fraud? Step 2: Read your business insurance policy very carefully. What does it say about fraud coverage? What are the limits and exclusions? Step 3: Unless 1 or 2 makes it real clear the business is not liable, get a lawyer.

Business insurance? That doesn’t sound like part of a minimum viable product.

[deleted]

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#8

Post by waste_monk »

>but I think it's more like a stolen credit card situation

How did the account get compromised? What was the nature of the attack (e.g. cryptocurrency mining, expensive egress traffic for file hosting, etc.)?

Every (consumer) credit card I've seen requires you to take reasonable steps to keep the cards secure to be eligible for fraud protection (e.g. changing the PIN if compromised, not lending it to people, alerting the issuer ASAP in case of suspected fraud, etc.). I do not use Azure but I would imagine that it works the same way - that is, if you fail to follow basic security precautions (enabling MFA, not using shared accounts or passwords that have been known to be compromised in a leak, etc.) you'll probably end up stuck with the bill. Hopefully you had things reasonably well secured.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#9

Post by kureikain »

Try to contact Microsoft support immediately.

Don't rely on the distributor/vendor, they act very slowly.

You're a customer of Azure, you can contact them by any mean, the fact you pay through a distributor doesn't change that relationship.

So I would open a Azure support, and also will try to find Azure team on Twitter/Hacker News etc and contact them politely for help.

There is no way you would have to pay this bill. They will sort out something or even waived it if it's the first time.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#10

Post by Krisjohn »

akerl_ wrote: post #6
nwiswell wrote: post #4

Step 1: Read your cloud services contract with Microsoft very carefully. What does it say about your liability for fraud? Step 2: Read your business insurance policy very carefully. What does it say about fraud coverage? What are the limits and exclusions? Step 3: Unless 1 or 2 makes it real clear the business is not liable, get a lawyer.

Business insurance? That doesn’t sound like part of a minimum viable product.

No post body was provided.
Post reply on HN