Emergency Response Plan When a Malaysian E-commerce Site is Hacked

A hacked e-commerce site is a severe financial and legal crisis. Customer data, credit card information, and business revenue are on the line. Every minute counts. Here is the technical emergency response plan.

Phase 1: Isolation and Containment

Do not immediately delete the server. You need logs to understand the breach.

1. Maintenance Mode: Put the site in strict maintenance mode via server-side routing (not a plugin, as the plugin might be compromised).
2. Snapshot: Take an immediate raw snapshot of the server and database for forensic analysis.
3. Revoke API Keys: Log into your payment gateways (Stripe, Billplz, DOKU) and immediately regenerate all Secret Keys and Webhook secrets. Update these in your secure environment later.

Phase 2: Eradication

Identify the entry point. Check access logs for POST requests around the time of the breach. Rebuild the application environment from a known clean state (e.g., via a secure Git deployment pipeline) rather than trying to patch a severely infected codebase. Force a global password reset for all admin users and customers.

Phase 3: PDPA Compliance and Notification

If personal data (names, emails, purchase history) was exfiltrated, the Malaysian PDPA requires swift action. While mandatory breach notification to the Commissioner is still evolving in amendments, you have a duty of care to notify affected customers immediately so they can secure their accounts. Draft a transparent, legally reviewed email explaining what happened and the steps taken to secure their data.

---

Need Expert Help?

In a crisis, you need experienced incident responders. JagaWeb handles critical recovery for platforms handling sensitive data. Get our RM5,000 Ownership & Access Review to assess the damage and rebuild, or subscribe to our RM450/month Care Plan so you are never exposed in the first place. Contact us today.