---------- Forwarded message ---------
From: Amir from WPML <[email protected]>
Date: Sat, Jan 19, 2019 at 11:02 PM
Subject: WPML.org website was hacked - what you need to know


We're very sorry to report that our website got hacked. The evidence that
we have points to an ex-employee who planted a backdoor before leaving the
company.

[image: WPML logo]
<http://trailer.web-view.net/Links/0X558DF12400C031E96D3AC5022ACA664CC4A1F30A98E71593322C45B12BEE0E38927C076E40CD5211C2F8B693DAEBFD15F2F0DFF3DEE58E3A2AABFEF2BDB6552FEA45B0491EAE6318.htm>
Hi Christopher,

We're very sorry to report that our website got hacked. The evidence that
we have points to an ex-employee who planted a backdoor before leaving the
company.

That attacker did the following:

   - Copied the names and emails of our clients
   - Sent a mass email on our behalf
   - Defaced our purchase page and added a fake blog post


We're very sorry that we allowed this to happen. We'll take a lot more
precaution when others leave the company in the future. Of course, some of
our employees have access to sensitive material and we trust them to use it
wisely.
  Is there an exploit in WPML plugin?
The attacker did not modify the code in WPML plugins. We double checked
right now and we can confirm that the ZIP files that you are downloading
from us were not tampered with.
  Was payment information compromised?
No. We don't store payment information on our server. We use PayPal and
Stripe for payment processing and they store the payment details. When you
buy from us, we don't ever see your credit card number.
  Is my WPML account compromised?
Possibly. The attacker gained access to all client names and emails and may
be able to login to your account. This will allow the attacker to pose as
you on wpml.org.

Please log-in and *change your password
<http://trailer.web-view.net/Links/0XE6C439864A6CD8F567FC91E5DAE14FEB0350898079D056FC052EF3CF968CF3E88D4DC94AC55EC397C2F8B693DAEBFD15F2F0DFF3DEE58E3A2AABFEF2BDB6552FEA45B0491EAE6318.htm>*
.
  What's WPML team doing about this hack?
We're rebuilding the server from scratch, resetting all passwords and
locking down everything. Since the intruder had access to the server, we
can't tell what other holes there are, so we're building the site from
scratch. This will take us until tomorrow morning.

We'll write again once our site is secured again. Again, we're very sorry
for having lost your name and email to this intruder. Besides fixing the
site, we'll also take legal action.

- Amir