In short: If your online shop was hacked, three things matter at once: protecting customer data, securing revenue and proving that the shop is clean again. Affected? Get in touch now. Remotely, we take over containment, root cause analysis, cleanup and documentation, and we coordinate with your service providers.
Do not delete anything and do not rebuild anything right now. Before you remove files or restore the shop, files, database and logs must be secured. Call us or write to us on WhatsApp. The fastest way is Report an emergency.
Are You Affected? Signs in an Online Shop
With shops, more is at stake than with a business-card site. Watch for these signals:
- Customers report that their card or account was misused after ordering from you
- Your payment service provider or your bank asks about suspicious transactions
- fields, windows or redirects appear in the payment process that you did not set up
- orders, prices or vouchers were changed without your involvement
- the admin area shows unknown users or unusual logins
- your mail server sends spam in the shop's name, or customers receive phishing emails with your sender address
- files in directories for media, cache or plugins are new or changed although nobody deployed anything
- the load rises without a noticeable increase in visitors
What to Do Right Now
- Decide whether the checkout goes offline. As soon as payment or customer data could be at risk, take the checkout or the shop temporarily offline, for example with a maintenance page. The decision is yours; we advise on it.
- Delete nothing, overwrite nothing. No updates on the live system, no restoring of a backup.
- Prepare the payment service provider. Check which reporting channels your contract provides for, and keep the contacts ready.
- Keep the logs. Ask your host and agency to secure access, error and shop logs. Trade press advises keeping server logs from 20 October 2026 onward.
- List the access details: shop admin, server, database, payment portals, interfaces to merchandise management and shipping. Change passwords only after consultation.
- Inform internal parties: management, the data protection officer, the insurer. Notes on the policy are under Cyber insurance in the event of a claim.
- Tell us before your agency repairs the shop on its own.
How Does PHP SOS Help With a Hacked Online Shop?
- Assess the situation: Shop system, version, PHP version, host, payment methods, integrated services. We clarify what data is stored in the shop.
- Secure and contain: An image of files and database, securing the logs, blocking suspicious access, protecting the checkout.
- Determine cause and scope: We check core files, extensions, templates, scheduled tasks and database contents for manipulation and try to establish what may have leaked. Where the traces are not enough, we say so openly.
- Clean up and restore: Removal of malicious code or a rebuild from trustworthy sources, depending on the findings. The trade-off between the two is described in Rebuild or clean up?.
- Harden, release again, report: PHP version, permissions, admin protection, monitoring. You receive documentation that you can present to the payment service provider, data protection officer and insurer.
If the incident grows beyond the shop, for example to merchandise management or internal systems, we move into incident response. If you need to know in a legally sound way what happened, IT forensics may also be an option.
Customer Data, Reporting Duties and Communication
A shop holds names, addresses, orders and often payment references. As soon as such data could be affected, a deadline is running: the GDPR provides for a notification to the supervisory authority within 72 hours if a risk to the data subjects cannot be ruled out. Whether that applies in your case, you clarify with your data protection officer or a lawyer; we do not give legal advice. We supply the technical basis you need for it. More on the deadline: GDPR notification duty.
Communication to customers is part of the incident as well. How to inform factually, without concealing or speculating, is described in Informing customers after an incident and Crisis communication after an attack. We cover the option of a criminal complaint under Reporting to the police.
Shop Systems and PHP Version
Whether WooCommerce, Shopware, Magento or PrestaShop: all of them run on PHP. An update of the shop software does not close the PHP vulnerabilities PHP2Shell. The industry page IT security for online shops summarizes the particulars, and the platform pages WooCommerce and Shopware 6 go into the individual systems.
How We Release the Shop Again
A shop goes fully back into operation only when three things fit together: the malicious code is removed, the entry point is closed and the credentials are renewed. That includes admin accounts, database passwords, API keys for payment and shipping providers, and mail access. We check the checkout last with a test order so that it is visible that the payment process works unchanged. Afterward we recommend closer monitoring for the following weeks, because attackers like to test known victims again. There is no guarantee that nothing will ever happen again; what there is, is a documented state and clear responsibilities.
What You Should Send Us
- shop system and version, host, and if known the PHP version
- what was noticed first and since when
- notices from customers, bank or payment service provider, verbatim
- the name of the agency or developer who looks after the shop
- the state and location of the last backup
Why PHP SOS
We work Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. You get one contact who leads your shop incident from first contact to the close. We work remotely across Germany and Europe, put every step in writing and promise nothing that nobody can deliver. We work until the incident is closed and documented.
Affected? Call Us. We Help.
Every hour with a compromised checkout can cost customer data. Get in touch now, by phone or WhatsApp, and we take over from the first message. Report an emergency now
Frequently asked questions
Should I switch off my online shop immediately if it was hacked?
If customer data or payment processes are at risk, temporarily switching off the checkout or the whole shop is often the right decision. You weigh lost revenue against damage; we supply the technical assessment for it. The important thing is not to delete any files in the process.
Do I have to inform customers if my shop was hacked?
That depends on whether personal data may be affected and what risk there is for those concerned. Make the decision together with your data protection officer or a lawyer. Our report supplies the technical facts for it.
How do I recognize that foreign code at checkout is skimming payment data?
Clues are unknown scripts in the payment process, customer reports of card misuse after a purchase, or notices from the payment service provider. Only a check of the files and the database settles it reliably.
Can I simply restore the shop from a backup?
A backup brings you back clean only if it was made before the break-in and the entry point has been closed since. Both are often unclear beforehand. That is why we secure first and then assess together with you.
Does the emergency help also cover Shopware, WooCommerce or Magento?
Yes. The approach is similar for all PHP shops: secure, contain, find the cause, clean up, harden. We check system-specific features on the shop in question.