Case study · CAD content platform · United Kingdom
Hacked Magento 2 store rebuilt on a clean server while customers kept buying
A UK content platform kept getting reinfected, however many times it was cleaned. We built a fresh server, moved 20,000+ products, customers and orders across (476,648 rows in 18 tables), went through all 54 modules and switched over without closing the shop. They kept us on afterwards, starting with a rebuild of their subscription system.
- Magento 2.4
- Hetzner dedicated
- Plesk
- Redis
- OpenSearch
20,000+
Products migrated, none lost
476,648
Rows checked across 18 tables
54
Modules audited
01
Problem
Other developers had cleaned this Magento 2 store more than once. Every time, the infection came back.
The server kept falling over, it was sending out far more traffic than it should, and the host had flagged it.
02
What we found
The attacker had root. Nothing on that machine could be trusted, down to the system binaries.
Six separate backdoors, including webshells in media folders, an altered core file and cron jobs that put things back. Remove one and the others carried on.
A reverse shell was open to the attacker's server, so they could type commands on the box whenever they liked.
The server had been pulled into a DDoS botnet. That put the hosting account in danger as well as customer data.
Earlier cleanups had only deleted what a scanner flagged. Nobody had found how the attacker got in, or how they kept getting back.
03
What we did
We shut the reverse shell, blocked the attacker's outbound connections and stopped the DDoS traffic, keeping copies of the evidence as we went.
Before rebuilding, we wrote up how they got in, where each backdoor was, what data was exposed and which credentials had to change.
We built a new server from a clean image and moved across only code and data we'd checked. That came to 20,000+ products plus customers and orders, including products added while we worked (476,648 rows in 18 tables).
We went through all 54 modules and changed every password and key, from admin and database to SSH, API and payment. Then we locked down SSH, nginx and PHP, tightened the Cloudflare WAF, added off-site Backblaze backups and capped Redis memory.
DNS moved to the clean server following a written switch-over plan, and customers carried on buying the whole time.
04
Result
The store now runs on a clean, locked-down server with its whole catalogue and order history.
The old machine is gone, along with every password and key it ever held.
The client kept us on for more development, starting with the subscription system.
I came to Scopebit in a genuine emergency. My site had been compromised at root level with six backdoors, a running reverse shell, and a sophisticated DDoS attack all happening simultaneously. I'd tried other developers before and nothing had been properly fixed. Within hours of getting server access, Scopebit had identified everything the previous cleanups had missed, preserved forensic evidence, neutralised the DDoS, and had a full written report ready. They then rebuilt the entire site on a clean hardened server, migrating 20,000+ products, auditing 54 modules, configuring Backblaze backups, tightening Cloudflare WAF, and delivered a professional cutover report documenting every single step. What sets Scopebit apart isn't just the technical skill, it's the honesty. They flagged problems clearly rather than hiding them. If you have a Magento site and need someone who genuinely knows what they're doing, not someone who'll tell you what you want to hear, hire Scopebit. Best developers I've worked with in 20 years of running web businesses.