The incident Report regarding the very temporary issue we had last week (28th of March), with the incorrect tagging of Inbound/Outbound emails as viruses with the associated reason of “virus-scan02”.
Incident Report, EveryCloud
1. General information
Subject: Increased False Positive rate due to filter rule
Affected Services: Spam Filter (in/outgoing)
Affected Customers: Premium spam filter users
Issue start time: 28 March 2018; 11:00 UTC+2
Issue end time: 28 March 2018; 19:30 UTC+2
Due to multiple virus waves in CW13 (26 March to 1 April) the spam filter was adjusted and extended as a counter measure. This adjustment lead to an increase False Positive rate, resulting in emails being filtered with reason code "virus-scan02“.
3. Customer impact
Customers might have experienced an increased False Positive rate of emails being filtered, resulting in a small portion of incoming emails being quarantined and outgoing emails being rejected.
4. Issue root cause
The issue was caused by an incorrect filter rule, which was identified and reverted at 11:30 UTC+2.
5. Planned further steps
To resolve the issue as quickly as possible, we have reverted the change. Any wrongly quarantined emails (incoming and outgoing) have been identified through EveryCloud and where delivered in retrospect.
We are also reviewing our internal processes to prevent this behaviour from reoccurring in the future.
We apologise for any inconvenience this has caused.