We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a third party IT company looking into it and we can't find out where the breach is.

There seems to be no suspicious access on the database, and none of the website code seems to have been altered.

There are also no new admin users and no unexpected logins from existing user profiles in the logs. We have changed all passwords we can think of but they still seem to be able to get the order details. This guy had the same problem back in April (exactly the same, even the same name used Lucy Whetton) but he hasn't posted what the solution was.

Email phishing scam asking customers for card details

Does anyone have any ideas?

By the way, we have and are contacting all customers immediately to tell them not to respond to these phishing emails.

  • 1
    First off how do you know the emails are actually sent by your server ? Anyone can pretend to be sending from "[email protected]", that doesn't mean the mail actually came from there. Aug 28, 2015 at 19:19
  • 1
    In the example you provide, the phisher doesn't provide any order details. Is there any information contained in the phishing emails you are seeing that "authenticates" the email, such as order details? How does your stack collect order details, and what touchpoints does it have to any external systems? Does order information ever get emailed to anyone? Do you use any third party email marketing services?
    – Jesse K
    Aug 28, 2015 at 19:28
  • Have you looked at your email server? You mention the db and the website, but all the details one would need would be found in emails.
    – schroeder
    Aug 28, 2015 at 19:39
  • 1
    the phishing emails aren't being sent from our server, they are being sent from a gmail account that we don't own (set up by the hacker). The subject line of the email that is sent contains the order number and they reference each customer by name. The phishing email is sent to the customer about 1-2 hours after the order is placed.
    – PeteS
    Aug 28, 2015 at 20:10
  • 1
    @SteffenUllrich Thank you for your constructive comment, very helpful! As mentioned in my question, another user had EXACTLY the same hack, even down to the name used to sign the phishing emails. Therefore I was asking in the hope that perhaps one of you experts on stack exchange might have encountered this before and could tell me how they did it in your experience, this could help me narrow down where the breach is. Just because you don't know the answer, doesn't mean the question is bad!!
    – PeteS
    Aug 29, 2015 at 21:49

3 Answers 3


If you can't find the entry point of the hackers, and a "third party IT company" can't find it either, consider hiring a professional security firm to investigate the attack.

This is not an appropriate forum for product or company recommendations, so please don't ask specifically "who" to hire.

I have found that people who present at security conferences often work for reputable security firms, so you could start your searches there. Many places have regional conferences which might be better suited to offer you local assistance; there are national conferences, and even international conferences, all of which would provide access to many professionals.

Another approach is to contact your local law enforcement. While they likely won't have the resources or ability to investigate the hack directly, they may put you in contact with a national law enforcement agency who might have more resources; they might also offer the names of reputable security investigators you could hire.

  • Isn't this going a bit over the top when the most probable story is probably already known now? February the editor posts an alarming message requiring all users to update their software, begin of April the issue is published on the CVE database (although with no technical details), mid-april another SE user claims to be victim of the same issue... Aug 29, 2015 at 10:42
  • @WhiteWinterWolf, that's why I started the answer with "If you can't find the entry point of the hackers..." , which is what the original question asked about. Aug 31, 2015 at 18:55

What troubles me is that you mention there was another user affected by an attacker using the very same name "Lucy Whetton".

Are you by any chance using some standard well-known eCommerce website solution (or a custom one relying on some common framework)? Have you applied the latest available updates?

My guess is that the group behind this pseudonym knows of a security flaw affecting the web application you are using, and is scanning the web to find websites still using a vulnerable version.

In case of doubt, if you already had the latest updates available applied, you should get in touch with the software editor.

  • Yes we are using a system called X-Cart and to be quite frank, it is an older version which did not have all of the patches applied. I'm 99.9% certain that's how they got in, and we are of course going to patch the site. The fact that the same name was used with the other user, made me think that maybe this was a common hack that someone out there had come across and could help me pinpoint how they are reading order details. If they are already in the system somewhere, applying patches won't help. As a last resort, we will simply rebuild the site on a fresh version (fully up-to-date!).
    – PeteS
    Aug 29, 2015 at 9:56
  • 1
    Updating will most likely close the main door which would otherwise allowed them to come in again. Usually, when you see such kind of announcement from an editor company, this means that not updating will most likely bring you in hot water. However, you are true that there is still a possibility that, while having an access, they left a backdoor hidden somewhere else on your system. This lead you toward the next step of How do I deal with a compromised server?. Aug 29, 2015 at 10:18
  • The website has now been fully patched. I still don't know if they are still inside somewhere but I guess I just have to wait and see.
    – PeteS
    Aug 29, 2015 at 15:24

One of the things left to do would be too lookup for known security flaws on the XCart version you currently have. You mentioned that that is the e-commerce manager you are using and that you didn't update it to the latest version. Now, I am not sure which version you still use, but try to make a Google search to see if there are any disclosed exploits for it. By having a look myself I found, for instance, an SQL Injection vulnerability that could well be the cause of the problem. In those cases you wouldn't see new users, malicious code and so on, but simply "legitimate" SQL queries to you DB.

  • The exploit you are linking dates back from 2010. As stated in another comment (see below John Deters post), there is another flaw allowing "unauthorized disclosure of information" corrected by the editor in February, partially published in the beginning of April, and according to the search engines all reported "Lucy Whetton" phishing began in the middle of April. There is a very higher probability that the OP was victim of this one. Aug 30, 2015 at 8:12
  • I know it was old, I just wanted to provide an example. Moreover, the author of the question didn't provide any detail about the version in use. The answer was more about suggesting to perform a research on the currently disclosed vulnerabilities. In any case, the flaw published in April looks more likely to be the issue indeed. Aug 30, 2015 at 8:23

Not the answer you're looking for? Browse other questions tagged .