U.S.NEXT Dropped a 15-Year Client During a 69-Site Outage

U.S.NEXT cut off a 15-year Iowa client on October 15, after a cyberattack took down 69 government websites it also hosted.

Dennis Fett, co-owner of the Peacock Information Center in Minden, Iowa, said the Jackson firm’s owner called that morning to say his site would not come back. Hinds County had already moved residents to a spare domain. Fett had no second door.

U.S.NEXT Hosted 69 Government Sites When the Attack Hit

U.S.NEXT is not a one-shop host that happened to keep a peacock site on a spare box. The company, based at 6360 I-55 North in Jackson, sells design, hosting, and a private data center. Its own LinkedIn page claims over 800 clients in 24 states. A listing with the Mississippi Association of Supervisors says it hosts sites for more than 40 counties in Mississippi, Alabama, and Louisiana. David Crawford is named there as the contact and is listed elsewhere as CEO.

Hinds County Administrator Lynn Seals said the attack left 69 government offices without their usual websites. Madison County was one. Local officials also named Warren, Clarke, the City of Flowood, the Mississippi Civil Rights Museum, the Mississippi State Rating Bureau, and the Mississippi Board of Tax Appeals. West Point’s water and electric bill-pay page went dark. So did the Mississippi Association of Coaches site, which Executive Director Johnny Mims said froze paperwork for high school all-star games.

WHO WENT DARK ON THE SAME HOST

Ray Charles Burns, Warren County’s IT director, put the concentration in plain terms. A lot of Mississippi counties, he said, have sites that U.S.NEXT put up, and the firm holds a big share of that county-hosting work. When that shop went dark, the blast radius was public first and commercial second.

The Alternate Site Hinds County Stood Up

Seals told residents their tax files and personal data were not sitting on the hacked boxes. County servers were not hit, she said. Payment tools for tickets, tags, and taxes already ran on third-party sites, a point U.S.NEXT later repeated in its own notes.

We can assure our residents there has been no compromise of their personal data or tax information because our servers weren’t attacked.

Lynn Seals, Hinds County Administrator

Since October 9, hindscountyms.com has not been the door. Services moved to co.hinds.ms.us. Kristi Fields, office manager for the Hinds County Tax Collector, said people still walked into the old address in their browsers and hit an error, then had to be pointed at the new one. Roy Cox, IT director for West Point, said online water and electric payments were the sorest spot, and he asked residents to use the kiosk, the phone, or the counter instead.

Philadelphia Mayor Jim Fulton said the city’s site was down. Police Chief Eric Lyons said department mail on the same host had been dark for about five days. Neshoba County Sheriff Eric Clark said the last message he received was at 3:17 a.m., and the system looked to have failed in the early hours of Thursday, October 8. Those offices kept buildings, phone trees, and, in Hinds, a second domain. Fett’s shop is a two-person information service. The website is the shop.

Eight Days, Then a Phone Call

Fett had been on U.S.NEXT for 15 years. The peacock information center has run for about 30 years, selling facts and consulting to a small global audience that still finds him by search and by email. He described the stretch from October 8 through the morning of October 15 as eight days in limbo. Orders and consulting requests that landed in that window did not land at all.

I was kind of left hanging here in limbo for eight days, and then the first phone call I get is to tell me they’re not going to provide my web services anymore after 15 plus years.

Dennis Fett, co-owner, Peacock Information Center

He said the business was dead in the water until he could find a new home for the site. The same morning, October 15, U.S.NEXT brought POP and webmail back at 9 a.m. for accounts it still intended to serve. Fett got the other call. No public statement since has said he was given an export of his files, a copy of the mailbox, or a date when the old account would be unfrozen long enough to pull them.

He had already heard the worse mail news a few days earlier. After the firm posted that messages sent during the outage would likely never arrive, Fett said he had no idea who had written, and that his shop is the lone support around the world when someone needs peacock information. That is the part a restore of the home page cannot fix.

What Customers Were Told About Lost Mail

U.S.NEXT posted a running log of the outage on its own site, starting October 9 at 4 p.m. The notes are blunt about mail and quiet about why one long commercial account was ended.

THE HOST’S OWN RESTORE CLOCK

1. October 9, 4 p.m.: Many services are down, including email and websites. Staff are working with FBI and Homeland Security teams. Access is shut as a precaution while risk checks run. The firm says no personal client account information, including billing details, has been taken. It offers to help point DNS at another mail host.
2. October 11, 11 a.m.: Third-party pay tools on government sites were not on U.S.NEXT servers. Site-editor passwords sat encrypted in databases the firm says were not hit. Customer accounting sat in cloud systems it says were not hit.
3. October 12, 11 a.m.: Previously sent messages will likely not be delivered. Senders should resend after mail returns. Clients may move to Gmail, Microsoft 365, or another host. If U.S.NEXT holds DNS, record changes have to go to support@usnx.com. No ETA for mail or sites.
4. October 13, 4:45 p.m.: Hosted MailEnable is the priority. The firm says it hears the complaints and still has no full restore time.
5. October 14, 4:15 p.m.: Mail is due back the next morning, with a separate how-to post.
6. October 15, 9 a.m.: POP and webmail return at mail.usnx.com. IMAP is held. Users who keep mail on the server are told they must archive first or they can lose older messages.
7. October 16, 4:35 p.m.: POP and webmail are processing. Website restore is a multi-step software and hardware job with no firm estimate.

The IMAP note is the trap for anyone who never downloaded a local copy. The firm told remaining customers that IMAP returns at 9 a.m. on October 22, and that they must archive in Outlook, Thunderbird, or Apple Mail before that cutover. New security settings require SSL, IMAP on port 993, POP3 on 995, and SMTP on 465. Fett was already out of the account by then. He could not archive what he could not log into.

Federal Teams Are in With No Restore Date

The first company note on October 9 said staff were working around the clock with FBI and Homeland Security teams, and that the event would run more than one day. Madison County copied that language onto its own channels the same afternoon. The Mississippi Department of Public Safety said it knew of the attack and was working with local and federal partners, and that it is not a U.S.NEXT customer. A Hinds County official, identified as Smith, said the FBI was investigating.

Retired FBI special agent Richard Kolko said the pattern looks like ransomware, with crews overseas locking data and demanding payment to release it. U.S.NEXT has not named the method. It has described a shutdown “as a precaution” and a restore that still had no website date as of October 16. Those are not the same claim, and only the company’s own words are on the record for what it found on its disks.

WHAT WE KNOW

• The outage start: Fett and local sheriffs date the break from October 8. The company first posted on October 9 at 4 p.m.
• The government tally: Seals put 69 government websites on the same host. Named counties and state boards match that scale.
• The Fett call: On the morning of October 15, the company’s owner told him web service would not resume after 15 years.
• The mail path: POP and webmail returned October 15. IMAP is due October 22. Mail from the dark window is likely gone.

WHAT IS UNCONFIRMED

• The attack type: Kolko’s ransomware read is an assessment. The firm has not confirmed it.
• Other dropped accounts: Fett is the only commercial client on the record as terminated. No roster of other cuts has been published.
• Fett’s files: There is no public word that he received a backup, a mailbox export, or control of DNS the host may still hold.
• A site-restore date: The October 16 note still had no estimate for websites.

The company’s own data-center page still sells redundant Cisco routers, AT&T and Lumen circuits on diverse paths, APC battery packs, and a Guardian natural-gas generator. That gear is built for a blown circuit or a dead feed from the street. It does not bring a MailEnable box back once someone is inside the environment and the operator has shut access on purpose.

A Long Hosting Account Still Ends in One Call

From the host’s side, ending a small commercial account during a restore is a way to shrink the queue. Government sites have phone trees, spare domains, and elected officials on television. A peacock information shop in Minden does not. The call on October 15 fits that math even if no one at U.S.NEXT has said so. The cost lands on the customer who still needed the old disk.

WHAT A DROPPED HOSTING ACCOUNT TAKES WITH IT

• Inbound mail: Messages that arrived while the MX records still pointed at the dead host do not queue forever. U.S.NEXT said those sends would likely never be delivered.
• Server-side archives: IMAP keeps the live copy on the host. If you never downloaded it, the host’s cutoff is the last copy.
• Host-held backups: A panel restore is useless once the account is closed and nobody will open it for an export.
• DNS if the host held it: The October 12 note told remaining clients to send record changes to support. A dropped client has to get that same desk to move the name after the relationship is over.
• The evidence trail: Logs that would show whether the peacock list, or any other customer file, left with the attackers sit on systems the customer can no longer ask to search.

Jackson-area managed-IT firms started advertising email and website rescue for U.S.NEXT customers while the official restore was still running. That is what a concentrated regional host looks like when it stumbles: the public-sector clients stand up spare pages, and the commercial leftovers become someone else’s sales list. Fett’s problem is older than that pitch. He cannot migrate mail he never received and files he cannot download.

IMAP Comes Back October 22 Without Fett’s Site

On Thursday, October 22, at 9 a.m., U.S.NEXT says IMAP comes back for the accounts it still hosts. Website work continues with no published date. Fett’s 15-year file is not on that list. Seals can send a resident to co.hinds.ms.us. Cox can take a water payment at the kiosk. Mims can call a coach. The peacock inbox from those eight days is the thing nobody can stand back up, because the only party that still had it is the party that ended the account.

Anyone else still on that Jackson data center has a narrower job before October 22: archive the mailbox, copy the site off the panel, and confirm who actually owns the domain. Fett’s call is what it looks like when that work is left until the host decides the restore queue is already too long.