I think my server was hacked

[edvinmorales@hotmail.com 5]

Hello guys, I think my server was hacked and they accesed every user on my emby server and they downloaded my personal pictures from the server, i am a little concern about this issue because it was family pictures and things of that nature, wondering if there is a way to deal with this type of situation of a way to delete the content from where the pictures got downloaded., i have the ip adress that seem to be invalid or mayve it was a VPN  

Firefox Windows 88.177.86.82

[darkassassin07 664]

@Luke

@softworkz

@ebr

[Luke 42139]

Hi, do all of the users on your server have strong passwords?

[edvinmorales@hotmail.com 5]

Im sure they have an ok password but how could they navigate every user, than created a new user, update policies and than deleted that username they created, now i have blocked accces to my personal photos, but they already been downloaded

[Neminem 1580]

Are you and your users using Emby connect?

Did you disable remote access to you admin account?

Do you show users on login screen?

Does any of this look similar to your case?

 

[speechles 2059]

Have you ever posted "Emby server logs" on this forum and those disclosed your private API key? If they happen across your API key in any of those server logs those could be used to allow unscrupulus people to try to gain access to your server and start messing with things..

Always make sure to submit logs that you download through the server admin interface so they will get information removed, such as API keys, IP addresses, etc..

I am suspect you may have needed help very early on and some a$$hole found your logs with the api key in it and decided he wanted to be a d!ck. Apologies. You need to read the post that I have linked above. It will explain how this happens and how to prevent it.

Edited 45 minutes ago by speechles

[Neminem 1580]

We need to know what happened, right now we are all guessing!

We need more info about your setup and how you have configured Emby.

There are so many ways this can happen and so many option admin can forget or not know about what it does,

that can lead to this.