Blog by Wild Iris Marketing technical expert Chris Hanson. Of the post image, he says “This guy stole my mom’s laptop once. I tracked him online and got him arrested at the Starbucks he was in within two hours.”
On October 18th, late at night while watching TV and chilling, we received a monitoring alert from one of the websites in our server farm about a critical failure. It appeared some plugin or other code had updated or changed, and the website was now crashing and showing an error page. I paused the TV and went to look and see what happened. Most of our websites we only update deliberately every week, during off-peak but still waking hours, so we can mitigate any issues caused by an update breaking things (it happens). But a few sites and plugins are critical enough that we allow them to auto-update unattended because they may receive a high-priority security fix while we are asleep or otherwise not focused on updates. I suspected one of these urgent updates had conflicted with something else, and checked my web hosting tools to see what had happened.
The reality was much stranger and more concerning. It was not an autonomous plugin update. What had happened was that a premium, paid-for plugin had ITSELF had THEIR entire company website hacked, and the hackers used that foothold to then deploy malware to websites of their clients who used the plugin. A so-called “supply chain” attack. https://teamupdraft.com/blog/security-incident-october-2026/
There was no way for us or our security tools to prevent this, this was a “from the inside” attack using legit privileges.
Our security tools detected the site breakage and at 11PM we were cleaning and remediating and patching the websites impacted.
Credit Card Testing Attacks
At the same time, in the last few months we’ve seen an increase in stolen credit card testing attacks (“carding”). This is where a criminal has hundreds or thousands of stolen credit card numbers and wants to test if they are still working before they auction them off to other criminals who then use them to pay for significant fraudulent purchases (see https://blog.betterbird.eu/2026/03/credit-card-testing-on-stripe ). Cancelled credit cards are worthless but ones that can still purchase something are valuable to criminals. They verify that the cards are working by trying to mail-order very small-purchase items online and see if the purchase is approved. This bites e-commerce vendors because each of those attempts is fraud. Either it fails (and the merchant pays a transaction fee for the failed card authorization) or it succeeds, and the merchant ships a product which the recipient didn’t really order, and will probably cause a chargeback (even higher costs). Either way the merchant is harmed monetarily and in terms of credit card processing reputation. Too many chargebacks and fraudulent transactions and your fees and rates can be negatively impacted and you can even be cancelled by your processor as a high-risk client. Most of the time, these are overseas bots, but sometimes they use networks of hacked home computers in the US to launch their attacks. We even saw one effort from the Philippines that was clearly a single person sitting at a keyboard hand-testing card numbers. Plotting their attempts over time we could even see them start with vigor at the beginning of their day, quickly processing cards, then slow down as their morning wore on and their coffee wore off, take breaks (that coffee has to go somewhere) and lunch. We wanted to send that person a special message to go get an honest job and did their mother know and approve of what they were doing. But all we could do was block them.
Credit Card Account Number Grabber Attacks
Another e-commerce hack (through a plugin that hadn’t yet had a patch released) attempted to install a card-grabber malware that would steal customers’ card info to sell to other scammers. We caught that one within 10 minutes of it being installed.
Finally we’ve even seen a sharp rise in password/login attacks. Our security tools can usually block repeated attack attempts where vast numbers of passwords are guessed, so bad actors don’t usually try that anymore. But they DO look for passwords that have been exposed in other website breaches (like the Updraft one above) and hope that maybe you used your first dog’s name as the password on multiple websites, not just the one they have the logins for.
The take-away is this: In 2026, especially with some AI tools that are willing to assist with malicious efforts, hacking is massively on the rise online. What can be done about it?
There’s no one silver bullet, but at Wild Iris Marketing, we have a team of experienced people at the ready to defend our customers’ websites from the hacker whose motto is invariably reminiscent of the Terminator’s “I’ll be back.”
How We Suggest You Protect Yourself (Some with Our Help)
- Never re-use passwords and never use simple passwords. Wikipedia will tell you the worst offenders (“123456” is #1 https://en.wikipedia.org/wiki/List_of_the_most_common_passwords ). But any simple word is quickly guessable by bot, even if you “5p311” (spell) it funny. XKCD ( https://xkcd.com/936/ ) has a cartoon poking fun at these kinds of passwords and proposing a new and better method of just choosing four regular words and making a story out of them (“correct horse battery staple”). Oddly, “correct horse battery staple” is not a common password.
- Always keep your CMS (e.g. WordPress) and plugins up to date, never use abandoned or pirated plugins. We often prefer paying for plugins because at least then we know someone’s livelihood is on the line if they stop updating them. An abandoned free plugin from 8 years ago could be the downfall of your website.
- Use Two Factor Authentication on privileged accounts. Even if someone hacks your password, if they don’t have your 2FA they can’t get in.
- Monitor your website. We spot these issues because we and our tools monitor our servers and websites 24/7/365 and report errors.
- Consider third-party security tools like CloudFlare and WordFence. These harden your website and block huge swaths of attacks. We are making these mandatory for all sites we are hosting as of November 1st to protect your website and our systems as well.
Come With Us If You Want (Your Website) To Stay Alive
Our managed hosting provides our web hosting clients with these types of defenses. If you want to sleep easily knowing your website is solid, let us be the ones staying up all night protecting your site…even if it interrupts our binge-watching of Virgin River.
