🔓 Hack Incident Report

🔍 What Happened?

On May 27, 2026, an attacker (or group of attackers) gained unauthorized access to our web server and systematically deleted the contents of our database. The attack was targeted and deliberate — it was not an accident or a technical failure.

How they got in: We have now traced the attack vector. At the time of the hack we were running a beta version of the site on a separate subdomain — a development and testing environment that was accessible to the public. The attacker exploited a vulnerability in this beta site to gain access to the underlying server and its database, which was shared with the main site. The beta site was the entry point for the entire attack.

The attacker exploited a vulnerability and was able to run destructive commands against our database, wiping out nearly all stored records. Tables containing user accounts, uploaded content metadata, ratings, comments, messages, and site settings were dropped or emptied.

The physical files — photos, videos, and thumbnails — were partially deleted as well. Approximately 50% of all uploaded photos and videos were wiped from the server's file system entirely. The other half survived and have been re-added to the database. What was lost for those surviving files was the database records describing them (who uploaded them, when, what category, their ratings, etc.).

This is actually the second significant attack against our site in 2026. In April we dealt with a smaller SQL injection attack. This May attack was far more severe and specifically designed to cause maximum damage to our data.

💔 What Was Lost?

🔧 What Are We Restoring?

Despite the scale of the attack, we have made significant progress rebuilding the site from scratch. Here is where things stand as of May 31, 2026:

• ✅ Database schema rebuilt — All ~80+ tables have been recreated from our codebase.
• ✅ ~1,375 photos restored — Surviving photos re-added to the database as guest uploads. The other ~50% are permanently gone.
• ✅ 60 videos restored — Surviving videos re-added to the database as guest uploads. The other ~50% are permanently gone.
• ✅ 15 categories re-seeded — Photo and video categories are back.
• ✅ Admin accounts re-created — Site administration is operational again.
• ✅ Upload system working — New photos and videos can be uploaded again, including AI-powered upload processing.
• ✅ AI moderation system — Fully operational. AI reviews every new upload for content policy compliance using Gemini AI.
• ✅ AI body rating system — AI-generated body analysis and ratings are working on new uploads.
• ✅ Rating system — Functional for new votes. Historical ratings are permanently lost.
• ✅ Ownership claim system — A "Claim This Photo/Video" button has been added to all pre-hack restored content so you can reclaim your uploads.
• ✅ Google & X (Twitter) OAuth login — Social login options are back and configured.
• ✅ 250+ database columns rebuilt — The photos table had over 250 analysis columns that needed to be manually added back one by one. Done.
• 🔄 AI reprocessing queue — All ~1,500 restored photos and videos are being put through AI moderation automatically. Estimated completion: ~June 5, 2026.
• 🔄 User registration open — Users can register new accounts. Original accounts cannot be restored.
• 🔄 Content moderation in progress — Restored photos/videos are being reviewed and approved.
• 🔵 Staff team — We are rebuilding our moderation team. If you previously applied or volunteered, please reapply.

⚠️ What May Currently Be Broken or Missing?

We are actively working through bugs and issues. Here are known things that may not work correctly right now:

• Leaderboards — Will show incorrect or empty data until enough ratings accumulate.
• Achievement badges — Achievements tied to historical activity are reset.
• Profile stats — View counts, rating averages, and milestones are starting from zero.
• Some admin pages — Minor display issues on certain admin management pages as we fix remaining database columns.
• Video playback — Restored videos are queued for re-processing. Some may not play immediately.
• "Newest" and sort features — Restored photos show the restoration date, not the original upload date. We are unable to recover original upload dates.
• Stats pages — Site-wide statistics will be sparse until activity rebuilds.
• Some error messages — You may encounter occasional errors as we continue to patch remaining issues. Please report anything you see.

If you encounter a bug or broken page, please contact us or use the support ticket system — it helps us fix things faster.

�️ Every Fix We've Shipped Since the Attack

We are documenting this openly so you know exactly what has been repaired and what still needs work.

• ✅ Photo upload pipeline — Fixed a critical bug in the perceptual hash column that was silently blocking all new photo uploads from saving to the database.
• ✅ Video upload pipeline — Restored and verified. Video processing, thumbnail generation, and category assignment all working.
• ✅ AI moderation (photos) — Gemini AI review is running on every new photo upload. The AI flags problematic content, assigns body scores, and queues borderline content for human review.
• ✅ AI moderation (videos) — Video frames are extracted and sent to AI for review. AI moderation is active on all new video uploads.
• ✅ AI token limit increased — The AI reviewer was hitting a cap of 4,096 tokens (too low for full analysis). Raised to 16,384 — AI now produces complete, detailed body assessments.
• ✅ 250+ missing database columns re-added — The photos table lost 250+ detailed analysis columns covering body measurements, skin tone, hair, and feature scores. All manually reconstructed and deployed.
• ✅ AI status types restored — Re-added missing status values (manual_override, error) to the AI review status field so admin overrides work correctly again.
• ✅ Database JSON constraint fixed — A database-level JSON validation check was silently rejecting AI result data. Neutralised via a trigger that prevents invalid writes.
• ✅ Feet, legs, hands category detection — The AI was miscategorising feet/legs/hands photos into wrong categories. Category mapping logic corrected.
• ✅ Google OAuth settings — Admin panel settings for Google OAuth login have been rebuilt and are configurable again.
• ✅ X (Twitter) OAuth settings — Same for X/Twitter login.
• ✅ Photo & video ownership claim system — Built from scratch post-hack. Every restored photo and video shows a "Claim This" button. Logged-in users submit a claim and an admin verifies and reassigns ownership.
• ✅ Admin claims management page — A dedicated admin page for reviewing, approving, and denying ownership claims for both photos and videos.
• ✅ May 27 hack notice links — Updated all site-wide hack notices (homepage, photo pages, video pages) to correctly link to this incident report instead of the April incident.
• 🔄 Video AI reprocessing — All restored videos are queued for AI moderation. Running now in background.
• 🔄 Photo AI reprocessing — All restored photos are queued for AI moderation and body scoring. Running now in background.

🤖 AI Moderation — Reprocessing All Restored Content

Every photo and video that was restored after the hack needs to be re-analysed by our AI moderation system. This covers content safety screening, body analysis scoring, and category verification.

We currently have approximately ~1,500 items (photos + videos) queued for AI review. The AI processes one item every 5 minutes to stay within API rate limits and ensure thorough analysis per item.

While reprocessing is ongoing, restored photos and videos are still visible and rateable. AI body scores and detailed analysis tags will appear progressively as each item is processed. Content that fails AI safety checks will be automatically hidden pending manual review.

You do not need to do anything — this happens automatically in the background 24/7.

🙋 Reclaiming Your Pre-Hack Photos & Videos

Because all original uploader data was wiped in the attack, every restored photo and video is currently listed as an anonymous guest upload with no owner. We have built a claim system specifically to fix this.

How to claim your content:

1. Re-register your account — Create a new account at ratemybody.net/register.php. Your old account cannot be restored, but you can use the same username if it's still available.
2. Find your photo or video — Browse the site to find content that was originally yours. All restored pre-hack content is marked with a ⚠️ Pre-Hack Photo or 🎬 Pre-Hack Video badge.
3. Click "Claim This" — The button appears on every unclaimed pre-hack item. Click it while logged in. You can add a short message to help us verify it's yours (e.g. "this is from my 2024 upload session" or any other context).
4. Admin review — Our team reviews your claim. If approved, the photo or video is immediately transferred to your new account. You'll get a notification.

We will do our best to verify claims fairly. Original file metadata was lost in the attack, so we can't verify ownership automatically — but we will use all available evidence (file content, your claim message, and context) to make fair decisions. False claims will be denied.

If you uploaded many photos/videos and need to claim them in bulk, contact us and we can assist.

�📅 Timeline of Events

🚫 The Beta Site — Removed & Discontinued

The beta site that was exploited in this attack has been taken down, disabled, and permanently discontinued. It no longer exists in any form.

We have also decided not to pursue a new or replacement website. Our systems have grown to be highly complex and interdependent — safely migrating everything to a new platform would introduce far more risk than it would remove. We will continue operating and improving this current site, updating it progressively as we see fit.

The removal of the beta site eliminates the specific attack surface that was used against us. Going forward, any testing or development work will be done in a fully isolated environment with no connection to production data.

⚠️ Staff Team Update

During the process of rebuilding the site and the staff team following the hack, we discovered that a number of staff members had been engaging in serious misconduct.

Specifically, these staff members were found to have been:

• Contacting minors (users under the age of 16) through the site
• Sending inappropriate content to those minors
• Receiving inappropriate content from those minors

These individuals have been immediately removed from the staff team and all access to site systems and data has been revoked. We have reported these staff members to the relevant authorities. We are fully cooperating with any investigations.

The safety of minors on this platform is non-negotiable. We take this matter with the utmost seriousness. If you or someone you know was affected, please contact us at our contact page or reach out to the appropriate authorities directly.

The remaining staff team has been vetted and we are continuing to carefully rebuild our moderation team. We are sorry this happened.

📋 Policy Change: Age Requirements

Effective immediately following the hack, we have updated our age policy. Previously, we had permitted minors to hold accounts under certain restrictions. Because the hack wiped all accounts entirely, there are no pre-existing accounts to grandfather in — this gives us a clean break to enforce a clearer policy from day one of the rebuild.

The new rules are simple:

• 16+ — Minimum age to register an account and upload to clothed categories (swimwear, underwear, fitness, etc.)
• 18+ — Required to upload any content involving nudity, without exception

Anyone found to be under 16 will have their account removed without warning. Anyone under 18 found to have uploaded nude content will have that content removed and their account reviewed.

If you are aware of an account or upload that violates these rules, please report it to us.

🔞 Age Verification — How It Works & Its Limitations

We get a lot of questions about this, so we want to be fully transparent.

How we verify age: We do not perform document-based age verification. Uploaders are required to confirm they are 18 or older before submitting any content. Beyond that self-declaration, every upload is automatically reviewed by our AI system, which assesses whether the person depicted appears to be an adult.

What this means in practice: No automated system is perfect. AI age estimation has limitations, and self-declaration relies on honesty. Despite our best efforts, it is possible for content to pass through that should not have. We are aware of this.

What we need from you: If you ever come across content that you believe depicts someone who is underage, please report it immediately using the report button on the photo or video, or contact us directly. Reports are reviewed promptly and content is removed if there is any reasonable concern. You do not need to be certain — if something looks wrong, report it.

What happens when content is reported:

• The content is immediately flagged and hidden pending review
• A staff member reviews the report manually
• If there is any credible concern about the age of the person depicted, the content is permanently removed
• The uploading account is banned and, where appropriate, reported to the authorities

Anyone who knowingly uploads content depicting a minor will be permanently banned and reported to law enforcement. There are no exceptions to this.

🛡️ Security Improvements Made

This attack has pushed us to significantly harden the site. In addition to fixing the immediate damage, we have implemented:

• Full audit and patching of all database query code
• Removal of sensitive recovery and maintenance scripts from the server after use
• Tightened admin authentication and session management
• Improved error handling so internal details are not exposed publicly
• Server-side rate limiting on upload and authentication endpoints
• Ongoing review of file permissions and server configuration

We are also reviewing our backup strategy to ensure faster recovery in any future incident.

💬 A Note From Our Team

We want to be honest with you: this was bad. Losing almost everything our community has built — the photos, the ratings, the conversations, the profiles — is genuinely gutting. We're angry about it too.

But we also want you to know that we haven't gone anywhere. We've spent every available hour since the attack rebuilding, patching, and putting the pieces back together. The site is back. Uploads are working. The community can rebuild.

If you had an account before May 27, we are sorry — we cannot restore your account data. We encourage you to re-register and start fresh. If any of your uploaded photos or videos survived (as they likely did — we've restored over 1,400 pieces of content), we will work to re-attribute them to you where possible once you re-register and contact us.

To anyone who has been patiently waiting, asking questions, or sending kind words: thank you. It means a lot. We'll keep fighting for this community.

If you have questions not answered here, please reach out.