Fell for phishing

Did you click a link in a fake email and enter your login details, credit card information or other data there? It can happen to anyone. What matters now is to act quickly so the fraudsters can’t do anything with your data. What you need to do depends on which login details you entered. Work through the sections below that apply to you.

First, no matter which data is affected

• If you used the same password elsewhere, for example for online banking, online shops or social media, change it there too.
• If you entered credit card or bank details, call your bank immediately and have the card blocked.
• Run a full virus scan on your computer before entering new passwords. This is especially important if you opened an attachment from the email.

Client area admin.firestorm.ch

This is the most important access, because it also gives access to your hosting management, your servers and your invoices.

1. Log in at admin.firestorm.ch, click your name at the top right and choose «Change Password».
2. Turn on two-factor authentication. A stolen password alone is then no longer enough: Setting up two-factor authentication.
3. Under «Account Details», check that your email address and contact details are still correct.
4. Under «User Management», check whether a stranger has been given access to your account, and remove unknown users.
5. Under «My Services» and «Invoices», check for orders or changes you didn’t make.

Without two-factor authentication, we hold back a login from a new IP address and first send you an email (see Sign-in from a new IP address). If you receive such an email without having logged in yourself, click «This was not me» and change your password immediately.

Email mailbox

Change the mailbox password and check forwarding, out-of-office replies and filter rules. You’ll find the individual steps under Email account hacked.

Plesk users

If you created your own users in the hosting management (Plesk), for example for your web designer, and entered their login details:

• In the hosting management, open «Users», click the affected user and set a new password.
• Delete users you don’t know or no longer need.

FTP access

• In the hosting management, click «FTP» for the affected domain, choose the FTP account and set a new password.
• Delete FTP accounts you don’t know.
• Anyone with FTP access could change your website files. In the file manager, look for files with a modification date that doesn’t match your own work, and if in doubt, block the website temporarily (see below).

WordPress or another CMS

• Change the password, see Change WordPress password.
• In WordPress under «Users», check whether new administrators have been added, and delete them.
• Check whether plugins or themes you don’t recognise have been installed.

Root server

On a root server you are the administrator yourself; we have no access to the operating system. If you entered the root or administrator password:

• Log in to the server immediately and change the password of root or Administrator and of all other users with the same password.
• Check whether new users or SSH keys have been added (on Linux in ~/.ssh/authorized_keys) and remove anything you don’t recognise.
• Check scheduled tasks (cron jobs or Task Scheduler) and running processes for anything unknown.
• If Plesk runs on the server, change the administrator password there too.
• If you can’t rule out that a stranger was on the server, reinstalling is the safe way. Back up your data first.

Block the website temporarily

If you want to take your website offline until everything has been checked, protect it with a password. Visitors then only see a password prompt, and your data remains unchanged.

1. Open the hosting management.
2. Click «Password-Protected Directories» for the affected domain.
3. Add a protected directory and enter / as the directory name. This protects the whole website.
4. Set a user name and password and save.

Once everything is in order again, delete the protected directory in the same place and the website is immediately accessible to everyone again.

Open a ticket

If you get stuck, suspect that a stranger has made changes, or can no longer log in, contact us: via a ticket in the client area or, if you no longer have access, via our contact form. Tell us when you fell for the email and which login details you entered. Never send us your password.

Good to know: We never ask for your password by email and never threaten an immediate suspension. Only enter your client area password if the address bar of your browser shows admin.firestorm.ch. More in our article Phishing in emails.