While cleaning up a hacked Wordpress site, I got access to the hacker's database. What action should I take?

Question

I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc.

After dealing with this I noticed that the hacker had also compromised files of an old copy of the site which was still in the public_html directory (or they'd created it themselves).

Checking the wp-config file there, I found access credentials to a database with several thousand tables, all of which were Wordpress tables with different prefixes. I looked in a few of the "options" tables to find the address and visited that url, confirming my suspicion that these were copies of other hacked site's data.

It's important to note that I haven't accessed any personal data, only public-facing URLs of wordpress sites.

I am unsure what to do about this - my instinct is to try to get a list of site owner emails from this database, then drop all tables & contact the site owners to let them know of the breach. However I'm not sure if I'd be liable for this as I'm obviously not permitted to have that data either.

I'm in the UK so GDPR is relevant.

Should I take any action?

Answer 1

I would certainly let the site owners know if possible. This looks like a GDPR breach of the other website. First and foremost, their breach, their primary responsibility.

You are now responsible for not allowing any personal data (if you have any) to go any further. Although you would probably want to just delete it unless it becomes necessary for evidence.

It is worth considering if you should report to the ICO yourself, although it is not your data or a breach of your system. Also, you are unlikely to know how serious the breach to the originating system is.

From the ICO website... (The bold text is theirs)

If you experience a personal data breach you need to consider whether this poses a risk to people. You need to consider the likelihood and severity of the risk to people’s rights and freedoms, following the breach. When you’ve made this assessment, if it’s likely there will be a risk then you must notify the ICO; if it’s unlikely then you don’t have to report. You do not need to report every breach to the ICO.