Victoria Bampton's Website Has Been Hacked!

To anyone following his thread.

Victoria Bampton did explain how she and the security experts arrived at the conclusion that her site is once again clean, safe, and secure. Please refer to your e-mail for all the details.

well...it's unfortunate that only those who receive an email will be in a position to judge for themselves, based on the information in the email, if the site is really safe or not.

For the many people in my position who have now been made aware that there was a significant security breach there might always be some doubt if the site is really safe or not because we won't be given the information contained in the email.

It's a pity, because had I not been made aware of the security breach, via your earlier post, there is a good chance I would have made at least one purchase from the site in the future. Now, given the uncertainty in the security of the site because I won't be given an opportunity to see the contents of the email, I will definitely not be purchasing anything from that site.  Perhaps most people in my position would have been better off if you had not made us aware of the security breach.

Basically, given the lack of information common sense says if it happened once, it could happen again (at least in my experience).

I wish I hadn't read your post in the first place

Hi guys

This thread popped up on my feed, so I just wanted to answer any questions anyone has, at least as far as I can.

Anyone can get hacked, but I've been as proactive and open about it as is humanly possible. I could have quietly fixed it and moved on, like most big companies, but I value your trust too much to do that.

Regarding financial details, the quote above is missing the rest of the sentence, so to clarify: I use hosted secure servers for payments through my website (run by PayPal and eJunkie), so no financial details are stored on or even pass through my own website servers. Therefore the hacker won't have found any financial records on my web server, from past or present orders.

What I can tell you about what happened: The hacker got into my website and changed the links on two of the purchase buttons, directing them from my eJunkie hosted shopping cart to his own PayPal payment page.

As soon as I discovered something odd was going on, I took the website down until I could identify the problem and fix it.

While investigating, I followed the hackers link right through the completion. Payment was only by PayPal account (hosted on PayPal's servers), so there was nowhere to skim any credit card numbers (although an understandable concern).

I identified 10 buyers, who looked like they may have been affected, and emailed them all personally to check and to help them report the fraudulent transactions to PayPal.

Having changed all of the passwords that could potentially cause any trouble, I handed the website over to a Website Security company, for them to go through it with a fine tooth comb. They discovered a couple of backdoors introduced by well-known plug-ins and cleaned them.

Once the security company confirmed the site was clean, I changed the passwords again, and cleared all caches, before pushing the site live.

I then emailed my entire mailing list (at 3am) to explain what had happened and how to check they weren't affected. I also recommended that members change their passwords, just as a precaution. I've personally replied to hundreds of emails, double checking details, and so far no additional people have been found to be affected, so I'm hopeful that I caught it early enough.

Moving forward - I've retained the services of the security company for round the clock monitoring, to make sure I catch any potential exploits at the earliest stage possible, and I continue to leave all financial transactions to the experts.

I hope that helps to clarify, and if there's anything else I can help with, please just ask.