: Customer's financials compromised - they think it was my site Sorry for the title, this is a confusing problem and I wasn't sure how to make the title succinct. The background: I have a

Posted in: #Paypal #Security #ShoppingCart #Virus

Sorry for the title, this is a confusing problem and I wasn't sure how to make the title succinct.

The background:

I have a client's website which sell products. The purchasing is all done through e-junkie.com cart, payments through paypal.

The course is delivered by giving the user access to a password protected page on the site with embedded vimeo links.

(it's not the best process I know but the site has been like this for YEARS)

.....

The Problem:

My client has received an email from somebody who purchased on her site. Here is that email:

I am emailing you because once I paid for your course, my account has been hacked and money used for various purchases in the USA as well as creating Match.com fake profile under my name. From what I gathered talking to my IT, there may be a virus/hacker on your paypal link or video links have something that allows that to happen? I really don't know, but I just wanted to let you know. We contacted our bank UBS in Switzerland (where I live) and I'm chasing match.com admin to erase my profile (already started getting messages on my mobile from match.com people??!!).

........

The question: What is my course of action?

There are so many pieces of the puzzle on my end (website, e-junkie, vimeo) I'm not sure how/where/what all to check.

My first thoughts is that her personal computer has a virus on it and she was compromised there.

Could this have come from my site?

and a bonus question: why would a hacker sign her up for Match.com??

... Edit ...
My question was flagged for being opinion-based, so I've edited the question hopefully to be more specific to a course of action. If you still believe this question should be removed can you please let me know why and what I should be asking instead so I can keep it and get some assistance? Thanks