Thanks for the note.
-
Yes, I was asleep
-
That IPv6 address is not from my range (I take from Hurricane Electric, in the 2001:470:… range)
-
We have evidence that the intruder attempted to add their email to an admin account, download the user list, and get the database backup. No access was granted to the new email address; we assume they retrieved the user list; but that they could not get the latter (the database) because they had not yet got email address.
So we assume emails and handles have been compromised, but that the database has not been downloaded (nginx logs).
Are there other things we should look for? Many thanks.