Dynamics Community Forum Thread Details

Malicious Deleted of Records? - Bulk Deletion

We had 200,000 records deleted from our system. This was done with an Admin user we do not have access to. This is a partner hosted instance of CRM and only they have access to that admin user. Someone actually configured a bulk delete job, selected orders and then hit go. No query, no nothing. They just bulk deleted these records.

When I did a fetch query for the same time frame that was reporting 400,000 records deleted.

My question is, which total is correct? Is my fetch grabbing "artifacts of some kind" of the record deletions and that is doubling the number of records deleted? Or, my fear is, another job was set up somewhere else and another 200,000 records were deleted somewhere else?

It has been about a week and my partner still has not told me what transpired. I made sure to grab a file of deleted entries from the audit log and I did a screen grab of the bulk deletion history entry in CRM when I first noticed that this happened so I do have a record of what happened.

It clearly could have been a situation where someone thought they were in a dev or a UAT environment and deleted records by mistake but I still have no answer.

Today, the bulk deletion entry of the 200,000 record deletion is missing from CRM. In other words, when I go to all bulk deletion jobs, this specific job that was setup by that specific Admin user is no longer showing in the history. So the evidence that it actually took place is gone. The only way I think that can be deleted is from another bulk deletion job or a direct delete from the DB. I don't think you can just delete an entry from the bulk deletion history interface. I do not see that capability. Even so, a complete restore of records should not have removed this entry. Even if the deletion was a mistake, the history and entry that it took place should not have been removed.

I do not have a complete report of all deleted records from our system other than the file I grabbed from a fetch. We did have a major issue with missing orders but those seem to be restored at this point.

I find it suspect we still do not have an answer on what happened and if it was an accident or not. Now that bulk deletion entry is missing from the history. Also, now when I try to run an fetch, my fetch is timing out. So now I can't run that again either. I get this error now. Maybe its just a coincidence?

[Dynamics CRM Source] Warning: An exception has occurred while processing the service request, the same request will be attempted again after 4 seconds. KingswaySoft.IntegrationToolkit.DynamicsCrm.CrmServiceException: CRM service call returned an error: Cannot access a disposed object.
Object name: 'System.ServiceModel.Channels.ServiceChannel'.

I am feeling a bit paranoid at this point. Is my paranoia unfounded?

Thoughts on this from the community?

Hey!

Is this an Online environment, or hosted by a partner/CSP, based on OnPremise? If it's online, you should be able to see if table has dropped in size. Also, you can open a support request to Microsoft asking to validate rowcount and size reduction.

If it's an OnPrem hosted by a partner, this would be more difficult as you rely on that partner maintenance plan. Maybe it was some sort of maintenance scheduled? indeed, you should formally request an explanation for this, whether a mistake or a planned maintenance. From the error (exception connecting/TimeOut), it might be partner realized the error and restored back/Rolled back the change. But of course, they're the ones that have to provide this info.

Regards,

Quick Links