# Indices all gone but i don't think i did it

**URL:** <https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370>\
**Category:** Elasticsearch\
**Created:** [January 12, 2017, 12:25pm UTC](https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370 "2017-01-12T12:25:49Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 12, 2017, 5:35pm UTC](https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370/2 "2017-01-12T17:35:02Z")

</div>

See this thread:

> [@Ransom attack on Elasticsearch cluster?](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310):
>
> Today I found that all indices on our Test ES cluster was removed and one new index "warning" was created there. And I found following text from the raw index data: SEND 0.2 BTC TO THIS WALLET: 1DAsGY4Kt1a4LCTPMH5vm5PqX32eZmot4r IF YOU WANT RECOVER YOUR DATABASE! SEND TO THIS EMAIL YOUR SERVER IP AFTER SENDING THE BITCOINS... It is a tipical ransom attack on MongoDB recently: [https://www.bleepingcomputer.com/news/security/number-of-hijacked-mongodb-databases-is-going-up-as-more-hackers-are-f…](https://www.bleepingcomputer.com/news/security/number-of-hijacked-mongodb-databases-is-going-up-as-more-hackers-are-flocking-in/)

---

_[View the full topic](https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370)._