Sorry for the title, this is a confusing problem and I wasn't sure how to make the title succinct.

The background:

I have a client's website which sell products. The purchasing is all done through e-junkie.com cart, payments through paypal.

The course is delivered by giving the user access to a password protected page on the site with embedded vimeo links.

(it's not the best process I know but the site has been like this for YEARS)


The Problem:

My client has received an email from somebody who purchased on her site. Here is that email:

I am emailing you because once I paid for your course, my account has been hacked and money used for various purchases in the USA as well as creating Match.com fake profile under my name. From what I gathered talking to my IT, there may be a virus/hacker on your paypal link or video links have something that allows that to happen? I really don't know, but I just wanted to let you know. We contacted our bank UBS in Switzerland (where I live) and I'm chasing match.com admin to erase my profile (already started getting messages on my mobile from match.com people??!!).


The question: What is my course of action?

There are so many pieces of the puzzle on my end (website, e-junkie, vimeo) I'm not sure how/where/what all to check.

My first thoughts is that her personal computer has a virus on it and she was compromised there.

Could this have come from my site?

and a bonus question: why would a hacker sign her up for Match.com??

... Edit ... My question was flagged for being opinion-based, so I've edited the question hopefully to be more specific to a course of action. If you still believe this question should be removed can you please let me know why and what I should be asking instead so I can keep it and get some assistance? Thanks

closed as primarily opinion-based by John Conde May 2 '17 at 16:48

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Why would a hacker sign her up for Match.com? Hey! Everybody needs love. That is a good one. What a mystery. – closetnoc May 2 '17 at 16:06
  • Are you storing their credit card details? If you're using paypal you never store their card info and have paypal do most of the PCI compliance. It's also unlikely paypal would be the source of being hacked so you're not at fault. Are you using an ssl certificate? Scan your site for viruses. If you do choose to reply to them, maybe you can explain that you don't store credit card info because it's handled by a very secure merchant (paypal) and that you only have the email on file for records. If your site has no viruses, an SSL, and no other clients were hacked, it's a local thing for her. – Darius May 2 '17 at 22:16
  • @Darius - Thanks for your feedback. We aren't storing anything on the site. Paypal has all the payment information, and e-junkie has all the customer info (email, address, etc) We do have an ssl cert.. and I have scanned the site with a few different free security services (securi, qualys, etc) and nothing has stood out from them. So I am leaning towards sending them feedback similar to what you suggested. – trundles May 2 '17 at 22:26