Western Digital is advising owners of My Book Live storage devices to immediately disconnect them from the internet in response to reports that users are losing data. This issue is another reminder that you should always have at least three copies of any data that you value.
The disappearing data first emerged on the Western Digital support forum with user sunpeak reporting that, all of a sudden, his directories remained intact but the files themselves had disappeared. Other users quickly reported the same problem: their directories were present but the files contained within were missing.
User Marknj1 wrote: “All my data is gone too. Message in GUI says it was “Factory reset” today! 06/23. I am totally screwed without that data…years of it.”
A recent statement from Western Digital published on its forum states that “devices are being compromised by malicious software” prompting a factory reset that erases all of the data on the device. It added that customers should disconnect My Book Live from the internet in order to protect against the possibility of losing data.
Western Digital tweeted from its customer support account (323 followers) but has not made any announcements via its main Twitter account (90.6k followers) or Facebook page.
The issue is a reminder that any data that is of value should be stored with the assumption that a device or service will fail at some point. Layers of redundancy are recommended so that risk is spread across multiple storage systems.
Do you use Western Digital devices? Let us know your experience in the comments below.
It's not "allegedly".
That said, I have a WD Mycloud EX2 Ultra, the disks are fine but it's not a great NAS system at all, software is a bit lame and some stuff just doesn't work (for example the Wake on lan feature that stops working after a couple of hours from then you put the NAS on sleep mode).
I hope this mess serves as a lesson for WD so at least they don't stop security update on more modern deveices...
Some of the devices with issues have supposedly been EOL and unsupported since 2015, but this is not clear from the anguished cries in WD's user support forums. Also, the exact attack vector has yet to be disclosed, so "disconnecting from the Internet" may not really help. I would expect a "factory reset" to have removed the directory structure as well as the files -- maybe there's something else involved.
One user has reported that his firewall prevented his NAS from connecting to an outside address that seemed to be malicious, and so saving his bacon. Another with no issue says he had disabled auto update.
This may turn out to be another corruption of the supply chain, that is, a compromise of WD's servers. At this point I would not trust anything downloaded from WD's sites. Sigh.
.