Sorry for the title, this is a confusing problem and I wasn't sure how to make the title succinct.
I have a client's website which sell products. The purchasing is all done through e-junkie.com cart, payments through paypal.
The course is delivered by giving the user access to a password protected page on the site with embedded vimeo links.
(it's not the best process I know but the site has been like this for YEARS)
My client has received an email from somebody who purchased on her site. Here is that email:
I am emailing you because once I paid for your course, my account has been hacked and money used for various purchases in the USA as well as creating Match.com fake profile under my name. From what I gathered talking to my IT, there may be a virus/hacker on your paypal link or video links have something that allows that to happen? I really don't know, but I just wanted to let you know. We contacted our bank UBS in Switzerland (where I live) and I'm chasing match.com admin to erase my profile (already started getting messages on my mobile from match.com people??!!).
The question: What is my course of action?
There are so many pieces of the puzzle on my end (website, e-junkie, vimeo) I'm not sure how/where/what all to check.
My first thoughts is that her personal computer has a virus on it and she was compromised there.
Could this have come from my site?
and a bonus question: why would a hacker sign her up for Match.com??
... Edit ... My question was flagged for being opinion-based, so I've edited the question hopefully to be more specific to a course of action. If you still believe this question should be removed can you please let me know why and what I should be asking instead so I can keep it and get some assistance? Thanks