16

My forum just got hacked because I was lazy and didn't upgrade. I've fixed the issue, but how should I announce the hacking issue to the community?

What is the best way to communicate to my members the impact of the hack, or should I keep this information quiet? Am I obligated to tell the members that this happened?

15

Honesty is the best policy. Not to mention that if you got hacked it's likely someone will have noticed, unless it was purely back end and nothing was defaced on the front end. But even if it was only a back end hack, you need to assess the damage and let the community know what happened, especially if users credentials have been stolen or were at risk.

First of all make sure you're clear on what has happened. Assess the damage fully so you know that you're giving your community accurate information and the complete picture.

Secondly tell what you've done to readdress the issue and what you're doing to make sure it doesn't happen again.

Thirdly take responsibility for your actions (or lack there of in this case).

If you have a solid community they will respect you more for this in the end.

11

You are obligated to tell your members about a security breach that happened.

Reset all of your passwords!

It doesn't really matter what kind of hack it was, or if the attacker ever got near your well hashed (RIGHT?!) user passwords, first and foremost, invalidate them all. That's what I, as a user, expect from you after a breach.

If your forum software does not allow you to do that, switch to a better one.

Be transparent about it.

After you patch yourself up, and reset all of your users' password, you should inform all of the members of the breach via one or more of the following:

  • A pinned/announcement post on the forum.
  • A well seen banner on the front page, or on any page.
  • A mail to all of the users (Some users may opt out, so it's best to use it in conjunction with the other options).

Be as clear as possible, and as transparent as possible, without getting into the technicalities (There was an SQL Injection, good. The attacker used the login form to enter a query that basically allowed him to log in as the admin and take all of your passwords, bad).

The message should be short and sweet, describe what happened without getting into to much technical details. Also, advise your users to change their passwords on any services where they used the same password as your forum.

  • by US Law? US and EU Law? – jcolebrand Jul 29 '14 at 18:55
  • 1
    @jcolebrand I know for sure that it's by US law, and I'm almost sure that it's also by EU law. – Madara Uchiha Jul 29 '14 at 18:57
  • Should you by fiat reset their passwords before they login or force a password reset on next login? Some forum software may not allow one or either of these options, of course. – jcolebrand Jul 29 '14 at 18:57
  • I don't know what kind of forum software is used here, but yes, all passwords should be invalidated instantly. If you can't do that, switch to a forum software that can (because it's a critical security feature). – Madara Uchiha Jul 29 '14 at 18:59
  • 1
    I like the email suggestion. Many forums have top-of-the-iceberg active users, and a long tail of users who registered once to post a question and never came back. If these dead souls happened to reuse their online banking password on your forum (and they do so, even when they know they shouldn't), then you are obligated to try to get the information to them without expecting them to come to the forum to notice it. – rumtscho Jul 29 '14 at 22:23
5

It is a very good idea to tell the users what happened, without trying to scare the users. You don't have to get in to the technical details about the breach, but you could put a warning saying something like this on the front page.:

Notice Hello users, we suspect there has been a breach that has resulted in user data taken. For more information, click here.

[Dismiss]

You could have a link going to a relevant post. Also remind your users to change their passwords (or if you are really concerned, force a password reset). Emailing users (if possible) may also be a good idea.

Anticipate negative feedback (such as this shouldn't of happened, their insecure, other things) and try to reassure your users that their data is secure and safe in the future.

3

This depends entirely on the severity of the compromise. In general, honesty is your best bet, but you also don't want to cause unnecessary concern, so you should be careful to very clearly define what, if any, impact is possible to the users.

In general, people are bad at understanding technology and even worse at understanding security. Make sure you clearly explain what, if anything, your users need to do to protect themselves if anything may have been compromised. Don't rampantly speculate, but also don't fail to warn them if something is a possibility of impacting them.

If your passwords were anywhere near compromised, be sure to invalidate them and send user's notification as many users will have used the same credentials in more than one place even though they should not do that.

If it was a very minor breach, it might not be necessary to notify users at all, however if it could have impacted users in some way, let them know so you have a second set of eyes looking out for any other problems that may have occurred. It is also wise to make sure you consult with a security expert to verify the risk to your users in the likely event that you are not a security expert yourself.

Note, it may also be worth asking about this question with some more details about the actual breach over on IT Security where people are a bit better equipped to point out any possible security implications to your users that you haven't thought of.

2

Being clear about the whole issue is the best.

It shows that you feel responsible for the issue, as it might have compromised the users' security on other sites as well. Many users reuse passwords across sites.
If you don't tell them and they get to know about the issue afterwards (for whatever reason) it will be much harder for you to convince them that your community is able to handle their personal information.

Mistakes happen, users can accept this. But not telling them is unacceptable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.