A site where the site owner put off having updates done has been compromised with ransomware. This situation brings up a lot of questions. A Google search has not produced any answers. The server is on a university system where they lock things down pretty tight.

  1. Are there any stats on the ransomware infection rates for Drupal sites, esp. compared to other systems?

  2. What is the most common part of a Drupal site to be the hole for a ransomware compromise, ie. specific module, Drupal core, login function, Apache server function?


How did the ransomware get in?

The website most likely got hacked.

What is the most likely reason for a Drupal site to be infected with ransomware?

1) Well, doing exactly what that site owner did, putting off security updates which will leave you vulnerable.

2) Leaving the front door open: Allowing scripts, javascript/jQuery or PHP to be executed by regular users.

3) Not using Secure Login

For sites that are available via both HTTP and HTTPS, Secure Login module ensures that the user login and other forms are submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in the clear. Secure Login module locks down not just the user/login page but also any page containing the user login block, and any other forms that you configure to be secured.


This module does not and will not prevent your site from being 'hacked'.

This module scans the currently installed Drupal, contributed modules and themes, re-downloads them and determines if they have been changed. Changes are marked clearly and if the diff module is installed then Hacked! will allow you to see the exact lines that have changed.

Your Drupal site got hacked. Now what?

Not the answer you're looking for? Browse other questions tagged or ask your own question.