I worked on a Magento install where I found database dumps lying in the root index / i.e. the same directory as the magento base url. Like:

mystore.com/databasename.datethedumpwasmade.sql mystore.com/databasename.datethedumpwasmade.sql

The database name can not be guessed easily, now my question is how worried should I be about this. The possibilities that I see here for first finding out the filename of the dumps:

  1. There are bots roaming the internet searching for these dumps, for them to be effective they would need to have some way of figuring out the database name and then running through each possible date extension. Is this plausible
  2. At the time of creation, I'm assuming the developer has downloaded the dump via a browser and then not deleted it. Risk of the filepath having stuck in some log somewhere and hence automated bots being able to find it
  3. Other way of guessing/knowing such a file exist and downloading it

Assuming someone did obtain the database, even though MD5 hashed, I'd assume the reasonable thing would be to e-mail customers asking them to change their passwords. What computing power and determination is required to crack 80 000 passwords (of which 60 000 is not actually user accounts and mean nothing).

The files as such has been deleted of course.

  • 2
    customer passwords is not so important as emails , physical addresses, and orders history, for some shops it will be a fatal... – user2857 Aug 22 '15 at 14:59
  • 1
    This true, I guess the better formulation would be if an index.html is placed within the public_html, what ways are there to snoop out what other files that are in that dir. That someone has been able to download the database is obviously the main concern. – palmik Aug 22 '15 at 18:48
  • 1
    Was directory listing turned on? They don't have to know the file name to find it. – Fiasco Labs Aug 23 '15 at 5:00
  • The folder has a index.php and index.html in it, directory listing was not turned on no – palmik Aug 24 '15 at 4:34

Consider your site as compromised.

It is simple, the DBs where available and you have to assume the worst.

Tell your customers to change the password and tell them their information might have been compromised.

This is a terrible practice and you should be aware that there are high chances that the information stored in the DB is in the wrong hands now. You should be able to see if someone downloaded the DBs by checking the access.log file if you are using apache.

|improve this answer|||||
  • Yeap, roaming through the access logs is what I did. So far nothing. – palmik Aug 24 '15 at 4:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.