CCA Website Provider Suffers Denial-of-Service Attack

Members who accessed the CCA website in mid-June may have been surprised to find the site moving at a snail's pace or not responding at all. In particular, several trip coordinators sending email announcements were alarmed, although most emails did eventually go through. The cause: ClubExpress, the platform CCA uses to deploy the website (as do a wide range of nonprofits) was hit with a denial-of-service attack by unknown parties.

Such attacks are a form of malicious mischief accomplished by trying to overwhelm the server with thousands of requests for page loads in short periods of time. Organizations relying on ClubExpress started reporting problems around June 14. ClubExpress tackled the problem with both internal and external engineering teams and ultimately told website administrators that platform stability had been restored by June 25. No customer data, member databases, or financial records were compromised or hacked during the event, ClubExpress said. ClubExpress also told administrators that its engineers were working on steps to prevent attacks, including enhanced traffic filtering and improvements in the request-handling pipeline.

One CCA user who went to the site after operations were restored found that pages loaded without any formatting to make them usable as a practical matter. The issue was resolved by restarting the browser.