What Do We Reckon. Hoax?

[Doofus]

I got an email today:

It said:

We have hacked your website xxxxxxxxx.com and extracted your databases.
How did this happen?

Our team has found a vulnerability within your site that we were able to exploit. After finding the
vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server.

What does this mean?
We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your xxxxxxxxx.com was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates do. Lastly any links that you have indexed in the search engines will be de-indexed based off of blackhat techniques that we used in the past to de-index our targets.

How do I stop this?
We are willing to refrain from destroying your site's reputation for a small fee. The current fee is $2000 in bitcoins (BTC).

Please send the bitcoin to the following Bitcoin address (Copy and paste as it is case sensitive):
1JToMSCtc4nW3fNDUL4xV9QYqmyKJEYMdj
Once you have paid we will automatically get informed that it was your payment. Please note that you have to make payment within 5 days after receiving this e-mail or the database leak, e-mails dispatched, and de-index of your site WILL start!

How do I get Bitcoins?
You can easily buy bitcoins via several websites or even offline from a Bitcoin-ATM. We suggest you to start with localbitcoins.com, paxful.com or do a google search.

What if I don’t pay?
If you decide not to pay, we will start the attack at the indicated date and uphold it until you do, there’s no counter measure to this, you will only end up wasting more money trying to find a solution. We will completely destroy your reputation amongst google and your customers.

This is not a hoax, do not reply to this email, don’t try to reason or negotiate, we will not read any replies. Once you have paid we will stop what we were doing and you will never hear from us again!
Please note that Bitcoin is anonymous and no one will find out that you have complied.

So, in this nasty situation what steps should I take to secure my website, please let me know the best answer.

Thank you friends
Angel Swartz

The only thing I can find on the net is that several bloggers received rhe same email in April this year. Obviously, they don't have databases to compromise, so I'm inclinded to assume this is just a scam.

Can anyone on here shed any light?

[RDMcG]

It could be real but I doubt it -typically they execute the hack first and ask you to pay to reverse it.

[Saleen836]

Almost identical to the sex site scam that was doing the rounds last year, 'pay us xxxx amount in Bitcoin or we will send the video of you from your webcam while you were watching porn on the internet' type of thing

Just ignore it

[Doofus]

That's what I thought.

Incidentally, the only stuff in the database is the last three months' customer names and addresses, because I purge it every quarter.

Thanks partly to Covid-19, it's been a very quiet quarter, so no more than about 50 people can possibly be harvested.

[Dr Jekyll]

I got it, and the password quoted was one I used on one particular site years ago, I've changed it several times since. Coincidentally ClearScore announced a service for reporting passwords associated with your email address that have been found on the 'dark web'. This particular password was listed.

[Doofus]

Dr Jekyll said:

I got it, and the password quoted was one I used on one particular site years ago, I've changed it several times since. Coincidentally ClearScore announced a service for reporting passwords associated with your email address that have been found on the 'dark web'. This particular password was listed.

This email doesn't mention a password.

[Hoofy]

Saleen836 said:

Almost identical to the sex site scam that was doing the rounds last year, 'pay us xxxx amount in Bitcoin or we will send the video of you from your webcam while you were watching porn on the internet' type of thing

Just ignore it

I replied to one saying if they could send me a copy so I could wk to myself having a wk. They didn't reply.

[Hoofy]

Dr Jekyll said:

I got it, and the password quoted was one I used on one particular site years ago, I've changed it several times since. Coincidentally ClearScore announced a service for reporting passwords associated with your email address that have been found on the 'dark web'. This particular password was listed.

So probably just has your email and website account details, the website was hacked, and they're just hoping you'll fall for it as they can't do anything else with the info. Mass email the entire database from the hacked site and cross their fingers!

[Dr Jekyll]

Hoofy said:

Dr Jekyll said:

I got it, and the password quoted was one I used on one particular site years ago, I've changed it several times since. Coincidentally ClearScore announced a service for reporting passwords associated with your email address that have been found on the 'dark web'. This particular password was listed.

So probably just has your email and website account details, the website was hacked, and they're just hoping you'll fall for it as they can't do anything else with the info. Mass email the entire database from the hacked site and cross their fingers!

Precisely.

[DSLiverpool]

WordPress?

[bitchstewie]

Standard scam.

Lots going around with Coronavirus themes but we had this exact same one the other day.

Usual stuff applies like use a reputable hosting provider, use strong and unique passwords for any admin type logins, and if you're using anything that requires you to keep it updated (Wordpress leaps to mind) make sure you do so.

[Hoofy]

Dr Jekyll said:

Hoofy said:

Dr Jekyll said:

I got it, and the password quoted was one I used on one particular site years ago, I've changed it several times since. Coincidentally ClearScore announced a service for reporting passwords associated with your email address that have been found on the 'dark web'. This particular password was listed.

So probably just has your email and website account details, the website was hacked, and they're just hoping you'll fall for it as they can't do anything else with the info. Mass email the entire database from the hacked site and cross their fingers!

Precisely.

[Doofus]

DSLiverpool said:

WordPress?

No. Bespoke.

[DSLiverpool]

Interesting, aware of wp epidemic not anything else.

[yajeed]

Doofus said:

No. Bespoke.

What do the logs from the website tell you?

Odds are it’s a scam, it may not be, especially if you have any low hanging fruit - sql injection that can be detected without human testing etc.

The details you describe are pii, which is concerning.

Any passwords in that database? If so, are they adequately protected (hashed, salted etc).

[Doofus]

yajeed said:

What do the logs from the website tell you?

Odds are it’s a scam, it may not be, especially if you have any low hanging fruit - sql injection that can be detected without human testing etc.

The details you describe are pii, which is concerning.

Any passwords in that database? If so, are they adequately protected (hashed, salted etc).

I understand almost nothing that you just said.

[F31Simon]

I had exactly the same message earlier in the week and the site they had hacked and copied the database from is actually a static html site served up from an S3 bucket. There is no database or anything to be hacked. Utter rubbish as far as I’m concerned.

[Doofus]

F31Simon said:

I had exactly the same message earlier in the week and the site they had hacked and copied the database from is actually a static html site served up from an S3 bucket. There is no database or anything to be hacked. Utter rubbish as far as I’m concerned.

Yes, but had they actually hacked it?

[Simpo Two]

Worrying at first sight but bks in the calm light of day.

Option 1: Ignore it
Option 2: Pay them $2,000 - then they will say oh actually now we want $4,000 etc etc.

[jammy-git]

Gromm said:

Phishing. Ignore.

This.