Hacked, and five years without maintenance. Safe in 5 hours.
The server of a webshop with over a billion forints in yearly sales was hacked after five years with no maintenance. We moved the shop to safe infrastructure in 5 hours. Since then we have been rebuilding it piece by piece, while it keeps selling.
The call every webshop owner dreads
The server has been hacked. There is no time for a long analysis. First the system has to be safe. Only then can it be put in order.
What we walked into
We took the system over in its hacked state. The server had not been maintained for five years. The shop ran on an old codebase built on PHP 7.4 and Laravel 5.4, with the old API of a mobile app next to it.
And this was no small shop: more than two hundred thousand users, hundreds of thousands of orders, several hundred new ones every day. A day of downtime costs millions of forints. We had to move fast, and we could not afford a mistake.
Rule one: never clean up a hacked server in place
You cannot work calmly on a hacked machine. You do not know what else is on it, or when the next move is coming. So we did not start the clean-up there.
The first 5 hours
We took over the system and, within 5 hours, moved it to our own infrastructure: built automatically, behind a protective layer. An environment where we know exactly what runs, and where we can rebuild it at any time.
Then the long game: new next to old
Five years of skipped maintenance cannot be replaced in one go, and it should not be. The shop has to keep selling in the meantime.
| Where it stood | Where it is going | |
|---|---|---|
| API | Old codebase on PHP 7.4 and Laravel 5.4, plus the mobile app’s old API | New API on PHP 8.3 and Laravel 13, built next to the old one |
| Frontend | Old webshop | New frontend on Astro: done |
| Mobile app | Old app on the old API | Design of the new app: started |
Meanwhile we keep fixing the live system: order and item cancellations, payment confirmations, balance handling, content requests.
The new system grows up next to the old one, step by step. No big switchover over a weekend, and no downtime.
Where it stands
Since the move, the webshop runs on a safe foundation, out of reach of the hacked server’s risks. The modernisation continues alongside live traffic. All customers see of it is that everything works.
What others are afraid to touch is what we love.
What to take from it
- We do not clean up a hacked system in place. First we move it somewhere safe, then we put it in order.
- Skipped maintenance is not a saving, it is a loan. Sooner or later you pay it back with interest.
- We do not replace a large system in one step. We build the new one next to it and move forward step by step.
How long since your server was last maintained?
If you have to think about it, tell us what you run. We reply within one business day. Already hacked? See Rescue.