RANCHO MURIETA, CA (MPG) - Zeta Broadband restored internet service to its customers within about 12 hours after a massive cyberattack accompanied by an extortion demand knocked its California network offline July 19.

The Rancho Murieta-based internet provider refused to pay the demand and ultimately turned to a specialized cloud service to block the attack and restore service. Zeta described the incident as the largest cyberattack in the company’s history.

Zeta was not the only internet provider targeted. President and CEO William Burnett told the River Valley Times that information available to the company indicates several regional providers were hit by the same campaign, including Greenfield Communications, whose outage had disrupted internet service in Rancho Murieta just one week earlier.

“I do not have first-hand access to Greenfield’s technical data,” Burnett said. “However, based on its public statements and information shared through industry contacts, Zeta and Greenfield were not the only regional providers targeted by this type of attack.”

Burnett said the available information indicates the incidents were part of the same campaign. Both began on a Sunday, involved identical extortion communications and used large-scale, volumetric “carpet-bomb” distributed denial-of-service, or DDoS, attacks that spread malicious traffic across broad ranges of network addresses.

Burnett said he could not compare the technical details of the two companies’ outages because he did not have access to Greenfield’s technical data. What he could speak to, he said, was Zeta’s response.

Zeta initially tried to filter the attack locally and worked with its upstream providers. When those efforts proved insufficient, the company shifted to a specialized cloud-scrubbing service. At the same time, Zeta continued communicating with customers through mass email, Nextdoor and Facebook because the attack had knocked out its website and phone system.

“That combination of technical mitigation and continued customer communication remained our focus until service was restored,” Burnett said.

In a public account of the incident released July 31, Zeta said the attacker demanded payment in exchange for ending the disruption. Zeta refused, saying there was no assurance that paying would stop the attack or prevent future demands.

The company preserved the extortion communications and technical evidence and filed formal complaints with the FBI’s Internet Crime Complaint Center.

Largest Cyberattack 

According to Zeta’s public incident report, the attack reached hundreds of gigabits per second: many times the capacity of the upstream connections serving its network.

Unlike many denial-of-service attacks that focus on a single website, server or customer address, this attack distributed malicious traffic across Zeta’s public address space, affecting the company’s entire California network rather than a single community.

The first indication something was wrong was a cluster of seemingly unrelated alerts. Environmental probes and network sensors began dropping offline at nearly the same time.

Because those systems were unlikely to fail simultaneously – and another regional provider had been attacked exactly one week earlier – Zeta said it immediately suspected a DDoS attack.

As the network became saturated, Zeta’s website and hosted telephone system also became unreachable.

Burnett, who is a Rancho Murieta resident as well as Zeta’s president and CEO, told the River Valley Times that he understood what the outage meant for customers as soon as it became clear this was not an ordinary service interruption.

“As both a resident and the person responsible for the network, I understood what the outage meant for families and businesses that depend on us,” Burnett said. “Once our website and phone system also became unreachable, the priority was clear: determine what was happening, keep customers informed through whatever channels remained available, and restore service as quickly as possible.”

Four Zeta employees responded to the attack, Burnett said.

Although the company’s website and telephone system were unavailable, its separately hosted email system remained operational, allowing Zeta to send mass email notifications. The company also posted updates on Nextdoor and Facebook.

Zeta initially tried to mitigate the attack internally and then spent another three to four hours working with an upstream provider to filter the malicious traffic. Neither effort restored service.

“When those efforts were also unable to restore service, I was honestly beginning to feel defeated,” Burnett said.

At the same time, Burnett had contacted Cloudflare and other companies that specialize in protecting networks against large DDoS attacks.

The volume of malicious traffic was filling the internet connections leading to Zeta before it could reach equipment capable of filtering it, according to the company. That meant the attack had to be stopped farther upstream.

Zeta ultimately turned to Cloudflare, which routed the company’s internet traffic through a network capable of absorbing the attack. Malicious traffic was filtered out and legitimate traffic sent on to Zeta.

Burnett said emergency onboarding with Cloudflare took approximately five hours. Customer service was restored at approximately 12:20 a.m. Monday.

The following morning brought another challenge as Zeta employees responded to emails, phone calls and social media posts received during the outage. Some customers, believing the problem was with their own equipment, had reset their routers and needed help from Zeta staff to get back online, Burnett said.

The attacker also changed tactics again Monday morning, but Zeta and Cloudflare adjusted their defenses. Service stabilized, and subsequent attacks were blocked without another widespread outage.

Zeta said it found no evidence that customer information, passwords, billing systems or internal company data had been accessed, changed or stolen.

The purpose of the attack was to make Zeta’s internet service unavailable and use that disruption as leverage to obtain payment, the company said.

Before the incident, Zeta believed its network tools, staff and resources available through upstream providers were sufficient for the DDoS attacks it had successfully handled in the past. But the July 19 attack was unprecedented in the company’s history, which dates to 2006.

The attack demonstrated that protection against an assault of this size needed to occur farther upstream, before malicious traffic could overwhelm the connections leading to Zeta.

Zeta has now made specialized cloud scrubbing a permanent part of its network design so large attacks can be filtered before reaching the company.

Zeta also said it has strengthened monitoring and backup communications, established procedures to divert traffic more quickly and added systems designed to automatically detect and mitigate similar attacks.

Burnett said Zeta tried to keep customers informed throughout the incident even when it could not give them a definite restoration time. Updates were issued approximately every one to two hours when meaningful new information became available.

He said the company received considerable encouragement from customers during the response.

“We are sincerely grateful to them – and to the broader community – for their patience, understanding, and support during an extremely difficult time,” Burnett said.

For Rancho Murieta customers – including some who had recently switched to Zeta following the Greenfield outage the previous week – Burnett said he believes the company’s response speaks for itself.

“We restored service within approximately 12 hours and have since implemented additional protections designed to reduce the risk and impact of a similar attack,” he said.

Bill Burnett has been with Zeta Broadband LLC since its 2006 inception. The company’s goal was to provide reliable, high-speed internet service to communities overlooked by major providers.

Burnett purchased the company in 2020 and formed Zeta Broadband Inc., building on its original mission while investing in network expansion, new technologies and improved customer service.

Today, the Rancho Murieta-based company serves residential and business customers across Northern California, as well as the Southern Tier of New York and northern Pennsylvania.

“Although we’ve grown considerably over the years, we’ve remained a locally owned company focused on supporting the communities we serve,” Burnett said. “What has never changed is our commitment to providing reliable internet service and treating our customers like neighbors. That philosophy continues to guide every decision we make.”