Community Building Stack Exchange is a question and answer site for community managers, administrators, and moderators. It only takes a minute to sign up.
Sign up to join this community
My forum just got hacked because I was lazy and didn't upgrade. I've fixed the issue, but how should I announce the hacking issue to the community?
What is the best way to communicate to my members the impact of the hack, or should I keep this information quiet? Am I obligated to tell the members that this happened?
Honesty is the best policy. Not to mention that if you got hacked it's likely someone will have noticed, unless it was purely back end and nothing was defaced on the front end. But even if it was only a back end hack, you need to assess the damage and let the community know what happened, especially if users credentials have been stolen or were at risk.
First of all make sure you're clear on what has happened. Assess the damage fully so you know that you're giving your community accurate information and the complete picture.
Secondly tell what you've done to readdress the issue and what you're doing to make sure it doesn't happen again.
Thirdly take responsibility for your actions (or lack there of in this case).
If you have a solid community they will respect you more for this in the end.
You are obligated to tell your members about a security breach that happened.
It doesn't really matter what kind of hack it was, or if the attacker ever got near your well hashed (RIGHT?!) user passwords, first and foremost, invalidate them all. That's what I, as a user, expect from you after a breach.
If your forum software does not allow you to do that, switch to a better one.
After you patch yourself up, and reset all of your users' password, you should inform all of the members of the breach via one or more of the following:
Be as clear as possible, and as transparent as possible, without getting into the technicalities (There was an SQL Injection, good. The attacker used the login form to enter a query that basically allowed him to log in as the admin and take all of your passwords, bad).
The message should be short and sweet, describe what happened without getting into to much technical details. Also, advise your users to change their passwords on any services where they used the same password as your forum.
It is a very good idea to tell the users what happened, without trying to scare the users. You don't have to get in to the technical details about the breach, but you could put a warning saying something like this on the front page.:
Notice Hello users, we suspect there has been a breach that has resulted in user data taken. For more information, click here.
[Dismiss]
You could have a link going to a relevant post. Also remind your users to change their passwords (or if you are really concerned, force a password reset). Emailing users (if possible) may also be a good idea.
Anticipate negative feedback (such as this shouldn't of happened, their insecure, other things) and try to reassure your users that their data is secure and safe in the future.
This depends entirely on the severity of the compromise. In general, honesty is your best bet, but you also don't want to cause unnecessary concern, so you should be careful to very clearly define what, if any, impact is possible to the users.
In general, people are bad at understanding technology and even worse at understanding security. Make sure you clearly explain what, if anything, your users need to do to protect themselves if anything may have been compromised. Don't rampantly speculate, but also don't fail to warn them if something is a possibility of impacting them.
If your passwords were anywhere near compromised, be sure to invalidate them and send user's notification as many users will have used the same credentials in more than one place even though they should not do that.
If it was a very minor breach, it might not be necessary to notify users at all, however if it could have impacted users in some way, let them know so you have a second set of eyes looking out for any other problems that may have occurred. It is also wise to make sure you consult with a security expert to verify the risk to your users in the likely event that you are not a security expert yourself.
Note, it may also be worth asking about this question with some more details about the actual breach over on IT Security where people are a bit better equipped to point out any possible security implications to your users that you haven't thought of.
Being clear about the whole issue is the best.
It shows that you feel responsible for the issue, as it might have compromised the users' security on other sites as well. Many users reuse passwords across sites.
If you don't tell them and they get to know about the issue afterwards (for whatever reason) it will be much harder for you to convince them that your community is able to handle their personal information.
Mistakes happen, users can accept this. But not telling them is unacceptable.
