5

I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc.

After dealing with this I noticed that the hacker had also compromised files of an old copy of the site which was still in the public_html directory (or they'd created it themselves).

Checking the wp-config file there, I found access credentials to a database with several thousand tables, all of which were Wordpress tables with different prefixes. I looked in a few of the "options" tables to find the address and visited that url, confirming my suspicion that these were copies of other hacked site's data.

It's important to note that I haven't accessed any personal data, only public-facing URLs of wordpress sites.

I am unsure what to do about this - my instinct is to try to get a list of site owner emails from this database, then drop all tables & contact the site owners to let them know of the breach. However I'm not sure if I'd be liable for this as I'm obviously not permitted to have that data either.

I'm in the UK so GDPR is relevant.

Should I take any action?

  • It might be a good idea to call up a lawyer. GDPR is not easy to navigate, and by asking a lawyer for help, you are on the safe side. – MechMK1 Aug 22 at 9:49
2

I would certainly let the site owners know if possible. This looks like a GDPR breach of the other website. First and foremost, their breach, their primary responsibility.

You are now responsible for not allowing any personal data (if you have any) to go any further. Although you would probably want to just delete it unless it becomes necessary for evidence.

It is worth considering if you should report to the ICO yourself, although it is not your data or a breach of your system. Also, you are unlikely to know how serious the breach to the originating system is.

From the ICO website... (The bold text is theirs)

If you experience a personal data breach you need to consider whether this poses a risk to people. You need to consider the likelihood and severity of the risk to people’s rights and freedoms, following the breach. When you’ve made this assessment, if it’s likely there will be a risk then you must notify the ICO; if it’s unlikely then you don’t have to report. You do not need to report every breach to the ICO.

  • thanks for the advice - the data lost from our own site wasn't personally identifiable thankfully. There's no risk from our breach, but we opted to not try to use the other data or delete it, as we would only be assuming that it's stolen and also we don't have authorisation to access or delete that data. Two wrongs and all that. – jammypeach Aug 22 at 10:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.