# My ElasticSearch Indexes have been mysteriously deleted, how do I debug the cause?

**URL:** <https://discuss.elastic.co/t/my-elasticsearch-indexes-have-been-mysteriously-deleted-how-do-i-debug-the-cause/71460>\
**Category:** Elasticsearch\
**Created:** [January 13, 2017, 2:19am UTC](https://discuss.elastic.co/t/my-elasticsearch-indexes-have-been-mysteriously-deleted-how-do-i-debug-the-cause/71460 "2017-01-13T02:19:26Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 16, 2017, 3:58pm UTC](https://discuss.elastic.co/t/my-elasticsearch-indexes-have-been-mysteriously-deleted-how-do-i-debug-the-cause/71460/7 "2017-01-16T15:58:06Z")

</div>

About the first message it has been fixed AFAIK in 5.1.2.  
The second problem is related to this I think:

> [@Ransom attack on Elasticsearch cluster?](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310):
>
> Today I found that all indices on our Test ES cluster was removed and one new index "warning" was created there. And I found following text from the raw index data: SEND 0.2 BTC TO THIS WALLET: 1DAsGY4Kt1a4LCTPMH5vm5PqX32eZmot4r IF YOU WANT RECOVER YOUR DATABASE! SEND TO THIS EMAIL YOUR SERVER IP AFTER SENDING THE BITCOINS... It is a tipical ransom attack on MongoDB recently: [https://www.bleepingcomputer.com/news/security/number-of-hijacked-mongodb-databases-is-going-up-as-more-hackers-are-f…](https://www.bleepingcomputer.com/news/security/number-of-hijacked-mongodb-databases-is-going-up-as-more-hackers-are-flocking-in/)

---

_[View the full topic](https://discuss.elastic.co/t/my-elasticsearch-indexes-have-been-mysteriously-deleted-how-do-i-debug-the-cause/71460)._