Amazon seller account hacked and orders altered, what should we do in the first hour?

Terminate all active sessions immediately. Clear browser cookies and reset passwords across all devices within the company. Delay the disbursement date in the payments tab to prevent automatic payouts from triggering.

If two-factor authentication was bypassed, it's very likely session hijacking via stolen cookies. One of your PCs might be infected with malware. As long as someone accesses the dashboard from that machine, attackers can re-authenticate even if you change the password. Disconnect the primary PC used for logins from the network right now and wipe it.

We had a similar incident last year where 18,000 EUR was about to be transferred out of our account. We called support within the first 40 minutes and managed to stop the transfer. However, getting the suspended account fully reinstated took 11 days, which cost us roughly 15,000 EUR in lost revenue.

Did any staff click on fake shipment tracking or invoice update emails over the last few days? They usually can't get direct access to these dashboards without a phishing attack.

don't panic but act fast. first thing call the warehouse and stop those 14 packages from leaving otherwise u lose both the inventory and the cash.

When something similar happened to us we noticed it in the middle of the night. The attackers had slashed prices in half, racked up hundreds of orders, and routed the money to their own accounts. We were sweating bullets until morning when we could call the bank and the platform. You're very lucky you caught it early; acting within the first hour makes all the difference.

Take these three steps without delay: 1) Suspend financial payouts through the platform, 2) Cancel any manipulated orders in the system that haven't shipped yet, 3) Take a screenshot of the altered IBAN details and file a cybercrime report with the police.

I wouldn't rush to make an announcement to customers just yet. If the attackers still have access to the system, they might see your messages and scam the buyers through different channels. Make sure you regain full control of the dashboard first.

You're right. Start with a small trial; don't commit to everything at once.

Most time waste accumulates in tasks waiting for approval. If you have questions, write them; I'll answer as best I can.

my questions are cleared up thanks.

You're right.

You're right. Solutions that work at a small scale collapse when you grow; I learned this late.

Don't hesitate to ask; those who don't ask always pay more. If I were you, I'd go this route.

There's one point I'm curious about. Most time waste accumulates in tasks waiting for approval.

When making a decision, first look at what data you have on hand. If you post the result here, it will help others too.

There's also a measurement aspect to this. Don't rely on a single measure; go layer by layer.

Taking notes for two weeks yields better results than a six-month estimate. This is my opinion, I'm not claiming it's absolute truth.

I went through the same thing two years ago. The real issue isn't the number, but what it's based on.

Good luck with that.

I feel the same way. When making a decision, first look at what data you have on hand.

Most incidents start with a leaked password, not a vulnerability. If I were you, I'd go this route.

Let's separate the concepts, they're getting mixed up. Don't hesitate to ask; those who don't ask always pay more.

Good luck with that.

i'll try it.