How did the ransomware get in?
How did the ransomware get in?


The website most likely got hacked.


  What is the most likely reason for a Drupal site to be infected with
  ransomware?


1) Well, doing exactly what that site owner did, putting off security updates which will leave you vulnerable.

2) Leaving the front door open: Allowing scripts, javascript/jQuery or PHP to be executed by regular users.

3) Not using Secure Login


  For sites that are available via both HTTP and HTTPS, Secure Login
  module ensures that the user login and other forms are submitted
  securely via HTTPS, thus preventing passwords and other private user
  data from being transmitted in the clear. Secure Login module locks
  down not just the user/login page but also any page containing the
  user login block, and any other forms that you configure to be
  secured.




Hacked!


  This module does not and will not prevent your site from being 'hacked'.
  
  This module scans the currently installed Drupal, contributed modules
  and themes, re-downloads them and determines if they have been
  changed. Changes are marked clearly and if the diff module is
  installed then Hacked! will allow you to see the exact lines that have
  changed.


Your Drupal site got hacked. Now what?