I worked on a Magento install where I found database dumps lying in the root index / i.e. the same directory as the magento base url. Like:
The database name can not be guessed easily, now my question is how worried should I be about this. The possibilities that I see here for first finding out the filename of the dumps:
- There are bots roaming the internet searching for these dumps, for them to be effective they would need to have some way of figuring out the database name and then running through each possible date extension. Is this plausible
- At the time of creation, I'm assuming the developer has downloaded the dump via a browser and then not deleted it. Risk of the filepath having stuck in some log somewhere and hence automated bots being able to find it
- Other way of guessing/knowing such a file exist and downloading it
Assuming someone did obtain the database, even though MD5 hashed, I'd assume the reasonable thing would be to e-mail customers asking them to change their passwords. What computing power and determination is required to crack 80 000 passwords (of which 60 000 is not actually user accounts and mean nothing).
The files as such has been deleted of course.