Hacked – are you safe?

I understand why big companies don’t like to share that their websites have been hacked. It would be far easier to brush it under the carpet. But if you’ve been following me for some time, you know that I’m always open and honest with you, and this is no exception…

What happened?

In the early hours of Tuesday morning (UK time), my website was hacked. Thanks to one of my security plug-ins, and an email from a reader (thank you Jenny!), I was quickly alerted and I immediately took the site offline to investigate. The site remained down until I was sure it had been fully checked and cleaned by security experts, even though it was during a busy sale period.

During the downtime, I posted updates on social media and personally responded to all of the emails flooding my inbox. As soon as the site was live again, I emailed my entire mailing list (which is run on Mailchimp’s secure server) to explain what had happened. I’m sorry if this worried you, but it was important to check you were safe.

The hacker had replaced the links behind two of the purchase buttons on a book purchase page with links to his own PayPal account. He used PayPal’s own secure servers, so he didn’t have access to any financial details, but he received the payments for the orders. A clever way of “earning” some extra cash! A total of 15 people were affected before I discovered the issue and shut down the site, and I’ve contacted them all personally.

Thank you for your support

It’s always worrying to hear that a site you frequent has been hacked. I’m sorry that this has happened and I’m doing everything in my power to ensure that it’s never repeated.

It’s been an incredibly stressful few days, and I’ve really appreciated the stream of encouraging emails from loyal readers. These emails have kept me going through some very long days and nights, and for that, you have my heartfelt thanks.

What now?

I would be a fool to tell you that the site is 100% secure, because that’s simply not possible in this day and age. If a kid can hack the Pentagon, and banks and large companies are hacked on a daily basis (even if they try to hide it), then nothing is completely safe. What I can do is tell you what I’m doing to make sure you’re as safe as possible…

The things I have always done to make sure you’re safe on my website:

• No financial details (past or current) pass through or are stored on my website. I can’t even access your financial details. All orders and payments are processed on secure servers run by two very well known companies, who understand website security far better than I ever could:
  • e-Junkie (aka FatFreeCartPro) handles my shopping cart. When you press an Add to Cart button, this is what you should see (desktop then mobile):
    
  • If you choose to pay by credit/debit card, the card details are collected on eJunkie’s secure servers before being securely handed over to PayPal for card processing.
    
  • If you choose to pay by PayPal, you’re redirected to PayPal’s secure servers.
• All software is kept up to date, as updates often include fixes for vulnerabilities that have been discovered.
• All admin/server passwords are long complex passwords and are changed frequently.
• A number of security plug-ins/services monitor the website, scan it regularly, and watch for any unusual activity.

Further changes I’m making to keep you safe on my website:

Your safety is my top priority, so I’m making some additional improvements:

• Although no financial/confidential information passes through my websites, both this Lightroom Queen website and Lightroom Forums have moved to SSL connections, as of now. You’ll recognize the http:// has changed to https:// and the lock icon appears in the address bar.
  
• I have upgraded my Sucuri monitoring, to more quickly pick up and defuse any possible threats. Sucuri are industry leaders in website security.
• The website firewall is also being upgraded. (Update 03:25 AM – done)
• Update 03:25 AM – two-factor authentication is now installed for administrators.
• I am reviewing all of my personal cyber security procedures and processes, for both home and work.

Making all of these changes in one go does mean you might find a few bugs over the next few weeks, but this is a worthwhile compromise. I’m working on finding and fixing any bugs, but if you spot anything that doesn’t look quite right, please just let me know.

What you can do to stay safe online

It’s scary to see all of the different ways that hackers can break into websites, and the website itself isn’t the only link in the chain. Most of us are aware of viruses and malware that can be installed on our personal computers. Hackers can also break into our home routers or take advantage of any unsecured connections we may use when we’re away from home, among other things. There are things we can do to help to protect ourselves.

The most obvious improvement is to ensure that we never use the same passwords on multiple sites. If one website gets hacked, which is inevitable in this day and age, then the hackers would have access to the other websites you visit. You don’t have to remember all these different passwords. There are some fantastic password managers available, some of which are free, and they’re safer than post-it notes covering your computer.

For more information on other things you can do to protect yourself online, visit the StaySafeOnline website.