It appears that a hacker introduced itself into our web site through an insecure WordPress plugin. The security defect has been corrected relatively quickly, but it left a wide open gap during a few days. The hacker was able to

1. create several privileged access points into the web site (administrator accounts).
2. modify posts and pages to add a script susceptible to bring a malware infection (that I could not more precisely identify).
3. modify the web site to point back to another infected web site.
4. modify the web site to create himself an additional backdoor entry point.

this most probably happened during the Friday November 9th night (or very early on Saturday November 10th). It hit four of my web sites in a row (on four other sites I caught the infection before it could become extensive or dangerous for the users/visitors).

The corrections I implemented allow me to assure that the incident is now (Sunday November 11th at noon) closed for all four infected web sites.

The consequences for you, the visitors:

1. it is possible (though quite unprobable) that some personal data have been taken, but it was not a clear objective of the hacker.
2. all users with an account on the web site have been informed, their passwords force-modified to a safer value (it appears nobody had really fragile or re-used password – my advice: never re-use one web site password on another web site).
3. during a few tens of hours, Roumazeilles.net was used to propagate one or more malwares to visitors of our pages and posts. My advice: Immediately check your computer with a good anti-virus.

I hope (and I believe) that this is all.

Technical details on this specific attack (we were not alone in the list of victimized web sites).

1. The site to be rebuilt in a matter of hours.
2. Passwords to be changed.
3. Several hours lost for nothing.

There wasn’t much to steal (the users are not very many). But it is impossible to know with certainty if hackers did not leave with a copy of the emails and associated user names. If you want to know what kind of data may have been revealed, you may check it on personal data summary page.

Apparently, the hacker(s) was (were) more interested in switching the user traffic toward a malware-loaded web site in a foreign country (probably hacked too) under the name of a little blue pony. If you remember being directed there, take time to check your computer with a good anti-virus software.

Feel free to contact me if you have questions.

• Worried about WordPress and GDPR? Start Here
• GDPR: What Does the New Data Regulation Mean for Your Website, Business and Data?
• How to make a WordPress website compliant to GDPR
• Automattic and the General Data Protection Regulation (GDPR)
• GDPR Compliance and WordPress Forms: Everything You Need to Know

Have a nice read!

Please, note: I am not a lawyer or your Legal Department, it all merely comes from my reading and my understanding.

Deployment

Cookies

First step (normally, this should be in place for quite some time already, since this started a long time ago): Add an informative message to inform visitors that you are collecting cookies.

I simply used a small plug-in (you can find others too) : Cookie Notice from dFactory.

Pros: It is working in various languges (and in English), it has been tested on more than 500,000 sites before mine, it starts in less than a minute.

Contact form

For many reasons, you will need to have a decent contact form (including to be able to answer GDPR-related requests). I recommend a simple and small (and free) forms editor like Ninja Forms.

In two minutes, you will have a working contact form. Don’t forget to add the checkbox with “By using this form you agree with the storage and handling of your data by this website” (This should be present on all your forms).

Then, you need to create a “Contact” page in WordPress. You will include the specific code to include the form you just created with the following shortcode:

Small GDPR support: Ninja forms allow you to setup forms without storing any data on the web site, reducing the load to comply with GDPR in simpler forms.

But, don’t forget to enable the sending of the confirmation message to the comment author (all the more because the post-form message includes mention of this confirmation – be consistent).

On top of this, if your web site includes a comment system (quite common fact), I recommend using a plugin to include the standard reminder checkbox: WP GDPR Compliance from Van Ons. Bonus: It makes some recommendations on various GDPR-related cases.

Data Protection Officer

Name somebody (with an email address) as the internal interface for all private data issues. It is not compulsory (for smaller teams) but it is so much clearer (and recommended) that somebody feels i charge of this (even the CEO). This person will be contacted bu visitors willing to know what data you collect and how to remove all their personal data from the web site (these are legal requirements).

Make sure that this person is reachable through a very easy interface (including the contact form or some other form).

Privacy policy

Above all, you must make sure that you can explain simply what are your intentions about private data you will collect (private data include email, name, IP address, etc.) and how you intend to comply with your legal obligations. This page must tell it all simply.

Try and write it right on the first attempt. You are legally bound to inform all your users any time you make a change (even simple ones)…

This is a WordPress page, rather than a poost (it must stay readily available and easily reachable by all even in the future).

I recommend to -more or less- follow the GDPR themes (it’s easier):

• Existence (or not) of a Data Protection Officer, in charge of the whole process of personal data handling
• Definition of data collection, handling, storing, transfer and removal processes
• Creation of a process to notify any data breach
• Explicit consent to data collection
• Right to access (and removal) of personal data

Access to personal data

You must give full access to any user’s personal data stored on the web site. This is realtively easy using a plugin (GDPR compliance from Scribit) and a specific page where you will only write the shortcode:

[gdpruserdata]

Of course, you can add some more details (refer to the plugin help information for more options).

Then, you can direct the requests to this page which will display the full breadth of personal data. As this is not a very nice page (rather dry reading), I recommend to keep it masked (I don’t feel it is necessary to show it permanently to all – answering requests should be enough).

Annoncement

Maybe not the worst or the most complicated, but I finally added a small message on the web site to announce the deployment of this whole process. Explaining is better than waiting for people to ask. And the message is positive: You care about your users and visitors.

1. A Privacy Policy.
2. When you submit a comment on the site, it is now explicit (through a checkbox) that you understand that this will imply our storing of some of your personal data, and that you consent to it.(« explicit » and « positive » consent).
3. Creation of a Data Protection Officer (that’s me!) in charge of answering questions and requests of modificaiton and removal of your personal data if you ultimately want to revoke your consent.

the objective is to make more explicit and fully compliant, the choices that we already made to respect our visitors, and their privacy. Like we do since the beginning.