[RawAlex]

My fear at this point isn't that an admin password might have been comprised, as much as what hidden damage could be done with such access. This could be anything from putting in a back door to allow for future access to modifying the NATS codebase to allow all sorts of potential issues.

I know John will freak at the suggestion, but with this level of access, a smart hacker would do something to make money with their access, such as substituting affiliate codes or otherwise trying to obtain income from the sites in question. With 400 installs, a good hacker would only need to get 1 signup per day per site (at, say $20) to clear almost 3 million a year through purloined signups.

While I am not suggesting that this is the case, I think that NATS people need consider the larger implications beyond a spam scam. One of the IP addresses tossed into the ring traces back to a well known group in Russia. This may be significantly larger than anyone would like.