https://arstechnica.com/gadgets/2021/06/mass-data-wipe-in-my-book-devices-prompts-warning-from-western-digital/ Skip to main content * Biz & IT * Tech * Science * Policy * Cars * Gaming & Culture * Store * Forums Subscribe [ ] Close Navigate * Store * Subscribe * Videos * Features * Reviews * RSS Feeds * Mobile Site * About Ars * Staff Directory * Contact Us * Advertise with Ars * Reprints Filter by topic * Biz & IT * Tech * Science * Policy * Cars * Gaming & Culture * Store * Forums Settings Front page layout Grid List Site theme Black on white White on black Sign in Comment activity Sign up or login to join the discussions! [ ] [ ] [Submit] [ ] Stay logged in | Having trouble? Sign up to comment and more Sign up GONE -- "I'm totally screwed." WD My Book users wake up to find their data deleted Storage-device maker advises customers to unplug My Books from the Internet ASAP. Dan Goodin - Jun 24, 2021 10:10 pm UTC Promotional screenshot of external hard drive. Enlarge Western Digital reader comments 54 with 45 posters participating Share this story * Share on Facebook * Share on Twitter * Share on Reddit Western Digital, maker of the popular My Disk external hard drives, is recommending customers unplug My Disk Live devices from the Internet until further notice while company engineers investigate unexplained compromises that have completely wiped data from devices around the world. The mass incidents of disk wiping came to light in this thread on Western Digital's support forum. So far, there are no reports of deleted data later being restored. All my data is gone "I have a WD mybook live connected to my home LAN and worked fine for years," the person starting the thread wrote. "I have just found that somehow all the data on it is gone today, while the directories seems there but empty. Previously the 2T volume was almost full but now it shows full capacity." Other My Book Live users quickly joined the conversation to report they, too, had experienced precisely the same thing. "All my data is gone too," one user soon responded. "I am totally screwed without that data... years of it." Multiple users reported that the data loss coincided with a factory reset that was performed on their devices. One person posted a log that showed unexplained behavior occurring on Wednesday: Jun 23 15:14:05 MyBookLive factoryRestore.sh: begin script: Jun 23 15:14:05 MyBookLive shutdown[24582]: shutting down for system reboot Jun 23 16:02:26 MyBookLive S15mountDataVolume.sh: begin script: start Jun 23 16:02:29 MyBookLive _: pkg: wd-nas Jun 23 16:02:30 MyBookLive _: pkg: networking-general Jun 23 16:02:30 MyBookLive _: pkg: apache-php-webdav Jun 23 16:02:31 MyBookLive _: pkg: date-time Jun 23 16:02:31 MyBookLive _: pkg: alerts Jun 23 16:02:31 MyBookLive logger: hostname=MyBookLive Jun 23 16:02:32 MyBookLive _: pkg: admin-rest-api "I believe this is the culprit of why this happens," the person wrote. "No one was even home to use this drive at this time." Advertisement The My Book is a popular storage device for consumers and businesses. It plugs into computers, typically through USB, but it can also be accessed remotely so users can access data or make configuration changes. The affected model, known as My Book Live, uses Western Digital cloud infrastructure to provide remote access. Western Digital discontinued the My Book Live in 2015. The support forum thread was first reported by Bleeping Computer. Disconnect now On its website, Western Digital advised customers to disconnect their My Book Live devices to prevent further attacks while the company investigates the mass wiping. In an email, Western Digital officials wrote: The incident is under active investigation from Western Digital. We do not have any indications of a breach or compromise of Western Digital cloud services or systems. We have determined that some My Book Live devices have been compromised by a threat actor. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. At this time, we are recommending that customers disconnect their My Book Live devices from the Internet to protect their data on the device. We have issued the following statement to our customers and will provide updates to this thread when they are available: https:// community.wd.com/t/ action-required-on-my-book-live-and-my-book-live-duo/268147 The limited amount of information available at the moment makes it hard to determine what's causing this mass data destruction. Western Digital's advice to unplug devices while the investigation continues is warranted, and users should follow it as soon as possible. In the meantime, My Book Live users are trying to manage the hardship brought on by the incident. "It is very scary and devastating that someone can do factory restore on my drive without any permission granted from the end user," one user wrote. "I need a remedy to this issue immediately as this is already incurring a great cost to me." Post updated to emphasize that only My Book Live devices are reported to be affected. reader comments 54 with 45 posters participating Share this story * Share on Facebook * Share on Twitter * Share on Reddit Dan Goodin Dan is the Security Editor at Ars Technica, which he joined in 2012 after working for The Register, the Associated Press, Bloomberg News, and other publications. Email dan.goodin@arstechnica.com // Twitter @dangoodin001 Advertisement You must login or create an account to comment. Channel Ars Technica - Previous story Next story - Related Stories Today on Ars * Store * Subscribe * About Us * RSS Feeds * View Mobile Site * Contact Us * Staff * Advertise with us * Reprints Newsletter Signup Join the Ars Orbital Transmission mailing list to get weekly updates delivered to your inbox. Sign me up - CNMN Collection WIRED Media Group (c) 2021 Conde Nast. All rights reserved. Use of and/or registration on any portion of this site constitutes acceptance of our User Agreement (updated 1/1/20) and Privacy Policy and Cookie Statement (updated 1/1 /20) and Ars Technica Addendum (effective 8/21/2018). Ars may earn compensation on sales from links on this site. Read our affiliate link policy. Your California Privacy Rights | Do Not Sell My Personal Information The material on this site may not be reproduced, distributed, transmitted, cached or otherwise used, except with the prior written permission of Conde Nast. Ad Choices