The technical question
A compromised website does not automatically prove that personal data left the system. Conversely, a cleaned website does not prove that earlier access never occurred. The assessment asks what data was reachable, what the malicious code could do, and which trustworthy records cover the relevant period.
- web-server, WAF, CDN, SFTP, and hosting logs
- WordPress users, roles, sessions, and application passwords
- forms, stores, and export functions
- database dumps and unusually large responses
- outbound connections and external endpoints
- malware capability and likely execution window
“No indicator found” means only that the available evidence contained no reliable indicator. It is not automatically equivalent to “no exfiltration”.
Keep technical and legal decisions separate
The investigation supplies a timeline, affected data stores, indicators, and limitations. The controller, data-protection officer, or legal advisor determines notification duties. GDPR notification can be time-critical, so technical facts should be preserved and escalated without speculation.
Act promptly without overclaiming
Avoid both premature reassurance and an unsupported assertion that data was stolen.
What does data exfiltration mean in technical terms?
Exfiltration means data crossed an intended trust boundary or became accessible to an unauthorized recipient. On WordPress, that could involve a database dump, abused export function, intercepted form submissions, an unauthorized administrator, or external JavaScript capturing values in a visitor’s browser.
Not every unauthorized file read involves personal data. Conversely, a compromised form can expose submissions without producing a visible full-database export. Begin with a data inventory: which data types existed, where they were stored, which components could access them, and which third parties legitimately received transfers?
Which finding classes avoid false certainty?
A consistent classification makes the conclusion reviewable:
| Class | Meaning | Example |
|---|---|---|
| Confirmed | A reliable source records access or transfer. | A complete request trail shows an export to an unauthorized destination. |
| Strong indicator | Several traces align, but one link is missing. | Export-capable code ran during unusual outbound traffic. |
| No indicator found | Reviewed sources contain no matching trace. | Available WAF and web logs contain no matching export route. |
| Indeterminate | Relevant evidence is missing or does not cover the period. | Access logs rotated before preservation. |
“Indeterminate” is useful risk information, not a failed answer. Treating it as reassurance would misstate the evidence.
How is a defensible timeline built?
Do not begin only at the discovery time. Find the earliest supportable deviation: a login, file upload, role change, scheduled task, or unusual outbound request. Normalize timestamps to one timezone and record server-clock differences.
Then correlate:
- component versions, deployments, and configuration changes;
- authentication and administrative events;
- file and database changes;
- web, WAF, CDN, and network activity;
- visible symptoms, detection, and containment.
A large response is not automatically a database dump. Its evidential value depends on the endpoint, identity, response type, volume, destination, and whether the pattern repeated.
What can malicious code analysis establish?
Assess code by capability, not only by signature. Could it query the database, read arbitrary files, copy form values, inject browser-side scripts, or contact external systems? Did it require authentication? Which triggers and conditions controlled execution?
Capability does not prove use. Code may make an export possible while the available records do not show it executing. A deleted remote payload may also prevent complete capability analysis. The report must distinguish “could perform” from “is recorded performing”.
Why are negative conclusions difficult?
Saying that no exfiltration occurred requires unusually complete visibility across the relevant period. Typical hosting environments lack one or more of DNS, process, database, or outbound-network logging. Short retention and intermediate proxies create additional gaps.
The absence of an event matters only if the reviewed source would reliably have recorded that event, covers the entire period, and remained trustworthy.
The indicator-based assessment therefore states its coverage and gaps. Evidence-preserving forensic work may additionally require disk images, chain-of-custody records, and reproducible tooling beyond a standard WordPress cleanup.
What belongs in the technical report?
A decision-ready report identifies the time window, evidence sources, timezone, integrity information, confirmed findings, indicators, rejected hypotheses, and open limitations. It also describes relevant data stores, observed attacker capabilities, and containment already performed.
The sample incident report demonstrates an anonymized structure. It is a methodological example, not evidence of a real customer case.
When should privacy and legal teams be involved?
If a personal-data breach is reasonably possible, involve the controller, privacy function, and legal counsel early. They assess risk, notification duties, affected individuals, record-keeping, and communications. The technical investigation supplies facts and uncertainty; it does not make the legal decision.
Do not wait for complete remediation before escalating internally. Preserve the relevant incident logs and document when the organization first learned which facts.