How can an update Magento site get hacked?
A Magento site like any site is vulnerable because it is connected to the internet. The more popular, the higher chance that someone or something (bot) will try and gain access to your website.
How can it get hacked is a loaded question, but typically leaving security vulnerabilities open for convenience SSH / FTP and not taking the proper precautions will invite trouble. Most of the time these services are left with default ports which are easily scanned for by bots and in turn are distributed to others for attempted access. Not properly applying security patches to the system (magento and operating system) can also leave the door open to a possible breach;
Failing to detect hacking attempts are generally because there is no mechanism in place to notify the system owner of the attempts. You also need to check you security logs regularly for suspicious activity.
Giving access to unknown developers could also open a possibility of them leaving a way to gain access in the future. I never give direct access to anyone I hire, if they need access they walk me through it but typically I only allow access to my dev server.
what can we do about it.
There isn't enough information but:
- Restore your files from a backup
- If no backup is available, take a note of all changed files (date/time stamp) and replace with known good ones
- Check all system users, remove any new ones that do no belong
- Change all passwords for valid users
- Change admin panel link
- Change all system passwords
- Disable any unused and/or unnecessary accounts
- Disable all non essential access points (ie: SSH, FTP)
- If you need SSH or FTP, change the default ports
Continue to monitor and block any suspicious IP blocks that are trying to access restricted areas.
If you believe any of your users data and information have been compromised, it would be ethical to inform them of the breach.