We believe it to be a user known as the Gr8 1, his IP is 68.253.180.138. It seems he found a way into the site using an unused account, then exploited it somehow to get admin status. He injected code into both TIMedia and Umbra, that was looging passwords, and we think that is how he destroyed Umbra's site. Also, when we restored his site, something in the PHPFusion install deleted everything in the tables and started over fresh, which is why it loads blank.
0 replies