Adeptcore, Inc. Status Page

Aug 13, 2026

We have received significant positive progress from the Phoenix datacenter. A third primary chiller has been successfully restored, and facility temperatures are continuing to stabilize. On-site datacenter staff are actively conducting all-hands physical inspections across core hardware and support infrastructure. Network connectivity to our cabinets appears to have been restored. While we await final, official confirmation from the datacenter that facility operations are fully stabilized, our engineering team has begun verifying environments and powering up systems, including the Horizon infrastructure, to confirm everything is fully operational. We will issue a final confirmation update as soon as systems checks are complete and once we receive confirmation from the datacenter that the outage has been fully resolved on their end.

Aug 5, 2026

All networking at this time has been restored, and we are seeing connectivity being re-established for all affected client machines. NetOps determined that the issue was a WAN routing outage with failover not propagating. We are investigating exactly why the failover has not worked and how to prevent this from occurring in the future. While we investigate, we will route all traffic to the failover route to maintain continued functionality. We will be performing maintenance overnight to bring ELK back to fully operational status. There will be no downtime involved for customers.

Jul 10, 2026 · resolved Jul 23

# **Root Cause Analysis Report** PHX Datacenter Ransomware Outage & Infrastructure Recovery   ## **Executive Summary** On July 10, 2026, a widespread outage impacted the PHX Datacenter environment, affecting customer virtual machines, storage arrays, and network connectivity. Initial indicators suggested a complex multi-layered hardware, power, or storage failure. However, as troubleshooting progressed, telemetry revealed suspicious activity on a dedicated storage/management server. Subsequent forensic log analysis established that the initial unauthorized access and compromise occurred on July 9, 2026. Prompt containment actions initiated on July 10 successfully neutralized and eliminated the threat actor's foothold within the network before the end of the day. Out of an abundance of caution, the engineering team isolated the storage network and initiated a disaster recovery protocol. Over 150 TB of data was successfully restored and validated from pre-incident point-in-time snapshots. Comprehensive log reviews and outbound traffic analyses identified no evidence of customer data exfiltration. Recovery efforts, including storage restoration, virtual network rebuilding, and credential rotation, were completed by July 23, 2026. ## **Timeline of Events \(Key Milestones\)** ·       **July 9, 2026:** Forensic log analysis identified this date as the initial point of compromise, when unauthorized access was established via an external entry point. ·       **July 10, 05:34 CDT:** Widespread outage reported across PHX Datacenter and virtual machines; investigation initiated with datacenter engineers. ·       **July 10, 10:36 CDT:** Identification of storage array issues; initiation of recovery and snapshot mounting procedures. ·       **July 10, 15:40 CDT:** Discovery of indicators consistent with a potential compromise on a dedicated storage/management server; machine isolated. ·       **July 10, 16:34 CDT:** President issues partner notification; storage network taken offline; disaster recovery operations begin. The threat actor's active foothold and unauthorized access vectors were fully eliminated from the network by the close of the day. ·       **July 11, 05:14 CDT:** Approximately 150 customer VMs successfully restored and verified from July 9 and July 10 backups; network reconstruction begins. ·       **July 12, 10:56 – 20:39 CDT:** Physical networking restored; teams manually rebuild virtual networking/WAN configurations. ·       **July 14, 16:14 CDT:** Official confirmation that an unauthorized third party deployed ransomware; outbound traffic analysis identifies no evidence of data exfiltration ·       **July 15 – July 21:** Ongoing individual recovery efforts for remaining edge-case customer environments, credential resets, and log reviews. ·       **July 23, 14:44 CDT:** Final customer environments restored; system stability validated; transition to formal post-incident review and remediation. ## **Root Cause Analysis** ·       **Primary Cause & Ingress Date:** An unauthorized third party used compromised credentials to gain access to an externally accessible remote access service within the PHX Datacenter environment on July 9, 2026. ·       **Attack Progression & Containment:** The threat actor leveraged the initial access vector to deploy ransomware on July 10, impacting underlying management servers and a portion of the hosted virtual infrastructure. Swift intervention neutralized the active threat and eliminated their foothold within the network by July 10. ·       **Contributing Factor \(Interconnected Layers\):** Interconnected storage, virtualization, and management layers allowed the disruptive activity to mimic widespread infrastructure failure initially. ·       **Contributing Factor \(External Access\):** External accessibility of the entry point permitted the initial intrusion. This exposure has since been remediated \(see Corrective and Preventive Actions below\). \(Note: Specific technical entry points are withheld from this report as a security precaution\). ## **Impact Assessment** ·       **Service Availability:** Total loss of customer virtual machine access and environment management capabilities beginning July 10, with phased restoration concluding on July 23. ·       **Data Integrity:** Restored environments were rebuilt from clean backups and storage snapshots validated as predating encryption activity \(primarily July 9 and early July 10\). ·       **Data Privacy / Confidentiality:** Based on an extensive review of outbound network traffic, throughput limits, and security logs, no evidence was identified that customer data was copied or exfiltrated from the environment. ## **Corrective & Preventive Actions \(CAPA\)** To prevent a recurrence and enhance overall infrastructure resilience, the following remediation steps have been executed or are underway: ·       **Environment Rebuilding:** Rebuilt all affected management infrastructure and virtual environments from trusted, pre-incident snapshots rather than attempting in-place cleaning. ·       **Access Control & Credential Resets:** Conducted a comprehensive audit of privileged access, reviewed administrative permissions, and performed a total credential reset across infrastructure, storage, and virtualization platforms. ·       **Exfiltration Forensic Verification:** Completed a comprehensive forensic review of historical network logs, deep analysis of traffic patterns from the incident window, and cross-device access audits to verify definitively that no data exfiltration occurred. ·       **External Attack Surface Audit:** Completed a comprehensive audit of all external IP addresses and internet-facing services across the environment; unnecessary external exposure was eliminated, and remaining external touchpoints were validated and hardened. ·       **Snapshot & Backup Coverage:** Extended point-in-time snapshot coverage to all storage platforms, including tiers previously outside the snapshot schedule, ensuring complete recoverability across the environment. ·       **Network Segmentation:** Strengthened network segmentation and access controls between external touchpoints, management planes, and production storage fabrics. ·       **Enhanced Monitoring:** Expanded log aggregation and security monitoring across storage, virtualization, and network layers to improve early detection of anomalous management activity. ·       **Real-Time Network Behavior & Exfiltration Monitoring:** Deployed additional security controls for real-time network traffic monitoring and anomaly detection to instantly identify malicious behavioral patterns, lateral movement, or potential data exfiltration attempts in the future.

May 1, 2026

In response to a critical cPanel vulnerability (CVE-2026-41940) disclosed by the vendor, we are proactively patching all cPanel servers across our environment. As a precaution while updates are rolling out, public access to the cPanel/WHM/Webmail management ports (2083, 2087, 2095, 2096) has been temporarily restricted. Your websites, email, and other services are not affected only the browser-based management interfaces. If you need access to cPanel or WHM during this window. Please submit a support request if you require access and we can setup a custom whitelist for you in the meantime. We expect all servers to be patched and normal access restored within the next 48–72 hours. We'll send a follow-up once the work is complete. Thank you for your patience.

Mar 30, 2026 · resolved May 1

This incident has been resolved.

Is Adeptcore, Inc. down right now?

Yes — Adeptcore, Inc. is reporting a minor incident as of Aug 28, 3:54 AM UTC.

What is Adeptcore, Inc.'s current status?

Adeptcore, Inc.: Partially Degraded Service. Alert24 checks Adeptcore, Inc.'s status page continuously and can notify you the moment it changes.

How do I get alerted when Adeptcore, Inc. goes down?

Alert24 monitors Adeptcore, Inc. and 3,700+ other cloud and SaaS providers. When an outage is detected it updates your status page automatically and pages your on-call team — no manual checks. Start free at alert24.net.