A fake ransomware scam is going around that targets website contact forms. It sends an email to the site owner with the subject “Your Site Has Been Hacked.” The body of the email claims the hackers have exploited a vulnerability to gain access to the site’s database and “move the information to an offshore server.” The email threatens to ruin the site owner’s reputation by selling the site’s database, notifying customers that their information has been compromised, and de-indexing the site with search engines using blackhat techniques.
Within the past few weeks, website owners have reported having received this email on various support channels, including WordPress.org, stackoverflow, and reddit. The sites in question have not been defaced, nor do they show any other evidence of tampering.
The Bitcoin Abuse Database has seen a surge of reports regarding this scam in May and June, logged under various Bitcoin addresses. The scammers send the email out indiscriminately, even targeting sites that do not have a database. So far the campaigns have not been very successful at convincing site owners to pay the ransom.
- https://www.bitcoinabuse.com/reports/1DQ2F5YsTGSEgvAeJSgjydb5i4jvPKDBW1
- https://www.bitcoinabuse.com/reports/1Bs6CYDuHy1UGLr5ccz2UxRNcPGpeAa7tz
- https://www.bitcoinabuse.com/reports/1Q1DF9rJS6fNDSpiV2iEA46BS1mNEaELtC
- https://www.bitcoinabuse.com/reports/12KLZzgrNX2DvbWQM7yQ1V9vPwy9JPvUKM
The Bitcoin Abuse Database advises visitors that extortion emails are 100% fake and those who receive them should not pay ransoms.
If you or one of your clients receive an email like this, rest assured that it is a scam that requires no action. If you want to be extra cautious you can change your passwords and use a security plugin to scan your files for changes. Otherwise, simply delete the email.
Photo: Unsplash