Was I hacked?

[allen074]

Hi - this morning I got a message (shown below). In the last 6 hours, 20 of my members have emailed me saying they have the same email. What does this mean? Someone hacked my forum? What should I do now to make sure there are no issues? the forum appears to be working ok.

 
Dear user,
Your account on HTMLCenter Web Development Forums has been locked because someone has tried to log into the account with the wrong password more than 5 times. You will be able to attempt to log in again in another 15 minutes.
The person trying to log into your account had the following IP address:
74.53.243.34

Thank you!

[slappy]

No, it doesn't mean you were hacked. It means that someone, using an IP from Texas, USA attempted to log in as several of your members, including you, by trying to "guess" passwords. The warning tells you that they tried your username more than 5 times without success and that your account was locked for security. Same for your other users reporting the problem.

You are not "hacked" until the attacker actually guesses someone's password and gains access as them. Only the admin or moderator users would be a potential problem for the Forum. For the other users it is just a "personal problem" with having a poor password.

Might be a good time to make sure YOUR userid is included in the unalterable / undeletable users in the config.php file:

// ****** UNDELETABLE / UNALTERABLE USERS ******
// The users specified here will not be deletable or alterable from the control panel by any users.
// To specify more than one user, separate userids with commas.
$config['SpecialUsers']['undeletableusers'] = '1,YOURUSERID;

Regards,

[allen074]

Thanks Slappy! Love the nickname!

[Wayne Luke]

It is in the includes directory. If it is not there then your forum wouldn't work.

[allen074]

Thanks Wayne!