Our site has been repeatedly hacked over the past week. This is our first Magento site and it has only been up a couple months. The hacker or bot, etc. will go in and disable the other forms of payment besides paypal and switch the account to a paypal account of their own. Obviously I change this back and reenable the other payment methods (which is just check/money order and is actually how we do most of our business). I also check for new users and eliminate those. Then they will do it all again a couple days later. I've changed my passwords. What do I need to do now? There is obviously some vulnerabilities I've not fixed. Perhaps some code that has been inserted somewhere (i read one post about new files in js and media folders but was unable to find any recent modifications by looking at the dates). Maybe I just need to update my Magento version to 220.127.116.11? If that is all I need to do, should I still backup all my data in the manner explained in the different magento upgrade roadmaps or should I just start from scratch since it can be assumed that my original data has been corrupted? Any and all help is greatly appreciated. Thank you.
First Your first responsibility should be to your customers. If someone was able to change your PP credentials then they could be able to inject code to steal their credit card numbers as well, unless your only payment method is PayPal. Even then they could be redirecting customers to a fake PayPal site and stealing their login credentials there as well. You should close your website until you are able to find out the exact nature of the exploit.
Second Report the PayPal credentials to PayPal: https://www.paypal.com/us/webapps/mpp/security/unauthorized-transactions
Third You can use this tool to scan for known vulnerabilities: https://magereport.com/
As with any security breach you should assume that all of your data has been compromised unless you have proof otherwise. Also, you may have some PCI liability here, so you should be careful if you choose to keep your website open until you are able to confirm that the exploit has been removed. If someone can change your PayPal credentials, then they may have also injected code to steal your customer's credit card numbers.
You should talk to your hosting company and have them investigate how you have been compromised. This may involve hiring a third-party company.
In general here are Magento best practices: https://magento.com/security/best-practices/security-best-practices
There are multiple ways someone can access your environment and those are not limited to the Admin Panel users so these methods may not help if you are already compromised. you should be able to look at your access logs to see if you are seeing traffic which is changing
- Set a custom Admin Panel URL: http://docs.magento.com/m1/ce/user_guide/configuration/url-admin-custom.html?Highlight=custom%20admin%20url
- Whitelist IP addresses allowed to access your Admin Panel: https://www.sonassi.com/blog/magento-kb/secure-your-magento-admin
- Enable captcha for admin login: http://docs.magento.com/m1/ce/user_guide/store-operations/security-captcha.html?Highlight=captcha
Please read the Magento article I linked to above and hire someone who has dealt with this before to assist you.