Attacking person or process deleted all tables from all databases present in the server. In every database they left a unique table called warning, with 3 rows containing this text (This same text, except for the name of databases and tables, in every database so I will transcript the text from one database only):
_x000D_
-TRANSCRIPT BEGINS-_x000D_
Hello,_x000D_
_x000D_
I am a security researcher from Sweden, _x000D_
having interest on web security and other focus areas._x000D_
_x000D_
Your database nominasql was breached by a 3rd party and files were backed up _x000D_
to their cloud hosting storage._x000D_
_x000D_
I accidently discovered this dedicated cloud storage and was able to secure the files._x000D_
_x000D_
It is scheduled to be sold online._x000D_
_x000D_
The short-term consequences of this data leak could be fees, fines and frustration._x000D_
_x000D_
To prevent this i will remove all files from online storage above_x000D_
and restore the database if needed._x000D_
_x000D_
please send exactly 0.1 bitcoin (BTC) to the following _x000D_
bitcoin address: 1MZmziRXLcwU3U3hM8gD9M5RExLzCE4cs5_x000D_
_x000D_
Contact by email one hour after payment complete: 7b1261fbd011@mailinator.com_x000D_
include this incidentId: 4f0a6d53-0ee9-4d0f-a7e6-d0fb8c068b3a_x000D_
_x000D_
I will email you the link to download the original _x000D_
binary dump file nominasql.sql.gz created with mysql mydumper_x000D_
_x000D_
I will also shred remove any files and terminate the cloud hosting account._x000D_
_x000D_
You can email to verify the data dump: 7b1261fbd011@mailinator.com_x000D_
_x000D_
* Please make sure to include the server ip address and _x000D_
this incidentId: 4f0a6d53-0ee9-4d0f-a7e6-d0fb8c068b3a._x000D_
_x000D_
To buy bitcoin instantly you can use paxful.com like services._x000D_
_x000D_
incidentId: 4f0a6d53-0ee9-4d0f-a7e6-d0fb8c068b3a_x000D_
-TRANSCRIPT ENDS-