Sorry for the title, this is a confusing problem and I wasn't sure how to make the title succinct.The background: I have a client's website which sell products. The purchasing is all done through e-junkie.com cart, payments through paypal.The course is delivered by giving the user access to a password protected page on the site with embedded vimeo links.(it's not the best process I know but the site has been like this for YEARS).....The Problem:My client has received an email from somebody who purchased on her site. Here is that email:I am emailing you because once I paid for your course, my account has been hacked and money used for various purchases in the USA as well as creating Match.com fake profile under my name. From what I gathered talking to my IT, there may be a virus/hacker on your paypal link or video links have something that allows that to happen? I really don't know, but I just wanted to let you know. We contacted our bank UBS in Switzerland (where I live) and I'm chasing match.com admin to erase my profile (already started getting messages on my mobile from match.com people??!!).........The question: What is my course of action? There are so many pieces of the puzzle on my end (website, e-junkie, vimeo) I'm not sure how/where/what all to check.My first thoughts is that her personal computer has a virus on it and she was compromised there. Could this have come from my site?and a bonus question: why would a hacker sign her up for Match.com??... Edit ...My question was flagged for being opinion-based, so I've edited the question hopefully to be more specific to a course of action. If you still believe this question should be removed can you please let me know why and what I should be asking instead so I can keep it and get some assistance? Thanks
Customer's financials compromised - they think it was my site
security;paypal;shopping cart;virus