Data Security has been compromised

Question

In my Magento 1.9 store, some of the Customer's Default Billing name and Address has been amended. I first got to know this when one of my customer complained to me about their name that has been changed in their profile and I thought it was a mistake caused at her side. However, after looking carefully into the store for the past 2 weeks, I can see some of customer names are getting amended.

I can see those customer addressed has also changed to Web agency company that claims to do Magento development (They are not Certified partner).

I have thought long enough to figure out how they have done such a thing, and I am still clueless. The access to DB is limited to localhost only, thus no one can access to DB with public address.

I can see the "Formkey validation on checkout is disabled". can this be the gateway for this security breach?

Answer 1

I don't know if that backend-setting is the cause, but I think that you may have a bigger problem. Here's what I would do:

1. Check your store with https://www.magereport.com/ to see if you have all patches. It also checks for some more (known) vulnerabilities. This could give first answers. If you are vulnerable to the Shoplift-Bug, go to your admin panel and check for any admin accounts that should not be there; delete them.

2. Take your store down. If someone is able to access customer data, that's not funny. If you operate inside the EU, even less funny after the latest GDPR law. The attacker could even make fake-orders in your shop and, depending on your billing agreements, have your real customers pay for it.

3. Check for malicious scripts inside your store code base. Vulnerabilities of a store are most of the time caused by installed extensions - maybe you use a plugin that lets users upload PHP files, which means they could upload a webshell, which again means that they are localhost and can do what they want. Or you use a plugin that changes the login behaviour for your customers, or anything else - from my experience, for example, a lot of slider plugins are vulnerable to SQL injections.

4. When you have identified how your shop has been compromised, close this vulnerability.

5. Change all your database, admin and whatever passwords.

6. The next step depends on the attack; most people would recommend it in any scenario, but if you only have a small shop and you are pretty sure that the attacker did not gain access, for example, to SSH or FTP, you may under careful consideration omit it: re-install your server including the OS. Then re-install your shop from scratch using the latest Magento version, or your current version but make sure to add all the patches.

If (3) and (4) are to complicated, you can omit them and go for (5) and (6) right away.

If this has happened before and you have no clue how they got in, think about switching your hosting company, because sometimes they also don't know what they're doing.

After that you should be able to re-open you shop safely.

Be sure to take all necessary legal actions, for example inform your customers if you store any sensitive data that could have been stolen - I mean, if I had access to your customer's addresses, a full export is the first thing I would do ;)