Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have received an email from the Data Center that we might have been under an MCO attack, we didn't know what that meant and all they could tell is that MCO stands for "Multiple Client Outage" and asked us to review our servers.
What is that and what should we do to check on the servers?
It sounds like one or more of the sites your data center is hosting may be under attack. What's wrong depends on the nature of the attack. If it's a "Distributed Denial of Service" (DDoS) attack against one site, it's a flood of data generated by a network of zombies; those levels of traffic can block access to any other servers hosted on the same machine or network segments. Other than a period of downtime, such attacks usually do not allow the attackers to enter the victim's computers, though, so there would be little risk that they hacked into yours.
Other attacks might be specific hacking attempts to break into some of their other client's hosting servers. So they might be warning you that the attackers are indiscriminately attacking other sites in their network, checking for holes that might lead them to their intended victim; and that you might want to examine your server logs to look for evidence of hacking attempts.
Finally, be aware that this could be a phishing email you received. If it also contains a link that reads something like: "Click here to access your server management system", it's indeed suspicious.
