Garmin services down, possible ransomware attack

[Rex Sanders]

Multiple news reports of Garmin under ransomware attack since yesterday, knocking out Garmin Connect, support phones, and manufacturing, plus this on their Twitter feed and home page:

News reports:

Garmin services and production go down after ransomware attack
https://www.zdnet.com/article/garmin-services-and-production-go-down-after-ransomware-attack/

Garmin hit by massive outage after possible ransomware attack
https://www.theverge.com/2020/7/24/21336881/garmin-ransomware-attack-outage-cause

Garmin Connect ransomware attack: What’s taking so long?
https://www.fastcompany.com/90532272/garmin-connect-ransomware-attack-whats-taking-so-long

I’m not going to login to inreach.delorme.com or launch any Garmin apps until this gets resolved.

— Rex

[John S.]

Could this in any way interfere with a rescue using one of their devices?

[Rex Sanders]

I just contacted GEOS about inReach SOS response, we’ll see how they respond.

https://www.geosresponse.com/contact-us.html

— Rex

[Rex Sanders]

I received this from GEOS, a short time after I asked the question:

If I push the SOS button on my inReach, will GEOS still respond?
Yes, we are aware of the issues their site is having but if you press the SOS on your device you will be directed to us and you will receive the assistance you need. We are unsure at this time as to when their website will be fixed, but rest assured that the SOS is functional.

— Rex

[Ian B]

https://www.bleepingcomputer.com/news/security/garmin-outage-caused-by-confirmed-wastedlocker-ransomware-attack/

Interesting read, suggests Inreach is affected but doesn’t elaborate regarding the SOS button.

[Rex Sanders]

Update from Garmin.com:

“Was any Garmin Connect customer data lost during the outage?

Although Garmin Connect is not accessible during the outage, activity and health and wellness data collected from Garmin devices during the outage is stored on the device and will appear in Garmin Connect once the user syncs their device.

I’m an inReach customer. Can I still use SOS and messaging during the outage?

inReach SOS and messaging remain fully functional and are not impacted by the outage. This includes the MapShare website and email reply page. The status for inReach can be found here.

I have a new Garmin product. When will I be able to pair it with Garmin Connect?

We are working as quickly as possible to restore Garmin Connect functionality. The status of Garmin Connect can be found here.

Was my data impacted as a result of the outage?

Garmin has no indication that this outage has affected your data, including activity, payment or other personal information.”

https://www.garmin.com/en-US/outage/

I’m still staying off Garmin apps and website logins until the all clear.

— Rex

 

[Rex Sanders]

More from https://status.inreach.garmin.com

Update – The Explore site and Explore app sign in are now working. Some features may not be fully available or work intermittently, such as syncing data between the web site and app. The Explore site map is available.

inReach billing (service activation and plan changes) is still unavailable.

inReach SOS and messaging continue to work.
Jul 23, 22:38 EDT

Update – NOTE: inReach SOS and messaging have been fully functional and remain so. This includes the MapShare web site and email reply page.
Jul 23, 11:38 EDT

Update – Garmin Sign In is also unavailable, so there is currently no access to the Explore app, the Explore web site, and inReach sync desktop app. MapShare is still available.
Jul 23, 09:49 EDT

Investigating – We are currently experiencing an outage that affects Garmin inReach and Explore, and as a result, inReach billing (credit card editing, service plan changes, and new service activation) is unavailable. However, inReach messaging (text, email and SOS) is fully functional. This outage also affects our call centers, and we are currently unable to receive any calls, emails or online chats. We are working to resolve this issue as quickly as possible and apologize for this inconvenience.
Jul 23, 09:14 EDT

Garmin Connect status is here. In brief, everything related to Garmin Connect is currently down.

— Rex

[Jeff McWilliams]

I have an InReach SE and am on the Freedom plan.  Currently in maintenance mode, but my wife and I are taking the 8yo grandson on a short backpacking trip in 10 days.  Hopefully things are back online by then so I can re-enable the InReach data plan for the trip.

I also have a Garmin ForeRunner watch.  Syncing data from the watch through Garmin Connect is currently broken.  However, i can get at my activity data by plugging the watch via the USB cable into a computer, accessing the files on the watch, and manually adding them to Strava, which is how I track hikes, runs, and mountain bike rides.

[Jerry Adams]

I successfully sent an inreach message july 22

[Dennis W]

This won’t resolve quickly. The University where I am employed suffered a ransomware attack 4 months ago. They are still sorting the mess out. Granted, the number of potential gateways for attack and malware spread are much higher than a company like Garmin, these sorts of attacks are different from a plain wrapper virus.

[Ryan Jordan]

FYI: inReach messaging seems to be working fine, same with Mapshare. I’ve been running messaging tests every day since the outage with no issues. I can’t access my Explore account though.

[W I S N E R !]

Strava athletes the world over are now freaking out that a few days of running or riding were for absolutely nothing…

 

[jscott]

Honest, I wasn’t involved…

[BlackHatGuy]

Uh huh. And where were you went the Garmin services went down?

[Rex Sanders]

A relatively new pattern in ransomware attacks is to grab sensitive information from the victim organization first, then encrypt their computers for ransom. “Would be a shame if all your customer PII and credit card info wound up on the dark web if you don’t pay.” It’s happened.

No evidence that this is what’s happening to Garmin, but I wouldn’t be surprised.

— Rex

PS – “Where were you …” could be anywhere with Internet access – even in the middle of a wilderness via satellite.

[jscott]

I was unsuccessfully trying to get my printer to connect to my Chromebook. so I might have accidentally taken down Garmin, or the Chase bank network for all I know. I have clumsy fingers.

[Jerry Adams]

noticed this, I don’t know if it’s useful or anything

https://www.cyclingweekly.com/news/latest-news/how-to-manually-upload-your-ride-to-strava-while-garmin-is-down-460646

[Rex Sanders]

Bad sign. Garmin home page has dropped all links to products and everything else.

Hope they can recover quickly.

— Rex

[Bill F]

Just back from the Sierra on Friday after 6 days and was able to successfully send/receive messages and mapshare the entire time.  Have not tried the websites affected since being back.  Thankfully no testing of SOS.  Sad to see and hope they get this sorted out.

[Brad Rogers]

I’m getting some functionality from Garmin Connect today, something I haven’t gotten since Thursday.

I compete with some people from work on miles per week and hopefully I can upload my activities before the end of the month.   I also had a PR cycling this past week I’d like to see in black and white.  I still run, but I think my days of running PR’s are over.

[Ryan Jordan]

Everything is working normally for me this morning with inReach and Explore systems. My Garmin Connect account is still offline.

[NoCO-Jim]

Garmin Connect back up for me, historical Activities dashboard looks OK.

[Rex Sanders]

Looking much better at Garmin:

We are happy to report that many of the systems and services affected by the recent outage, including Garmin Connect, are returning to operation. Some features still have temporary limitations while all of the data is being processed. We’d like to thank all of our customers for your patience and understanding.

Garmin Ltd. was the victim of a cyber attack that encrypted some of our systems on July 23, 2020. As a result, many of our online services were interrupted including website functions, customer support, customer facing applications, and company communications. We immediately began to assess the nature of the attack and started remediation.

We have no indication that any customer data, including payment information from Garmin Pay, was accessed, lost or stolen. Additionally, the functionality of Garmin products was not affected, other than the ability to access online services. Affected systems are being restored and we expect to return to normal operation over the next few days.

Details:

https://www.garmin.com/en-US/outage/

Bits of Garmin Connect are still a work in progress:

https://connect.garmin.com/status/

— Rex

[Rex Sanders]

More about Garmin inReach services:

inReach Activation Delays
Monitoring – inReach Activation and Plan Management is currently experiencing unusually high load. Customers may see delays of three or more hours when activating new devices or making plan changes.
Jul 27, 14:59 EDT

https://status.inreach.garmin.com

— Rex

[Diane “Piper” Soini]

I don’t use Garmin but I did notice that my GaiaGPS started to take a really really long time to figure out where I was. Plus there were a lot of fighter jets going over the whole time, and one day fighter jets were going over constantly all day in pairs until about 10PM. I thought there was a war.

[Author]

Posts