Case study · European Museum Forum · Aug to Sep 2026

A hacked archive,treated like a museum object.

The European Museum of the Year Award keeps a website for every edition: ten of them, 2022 to 2026, in English and French. In August 2026 they were compromised and taken offline. Over four weeks Via Creativa stabilised them, moved them onto infrastructure the forum owns outright, gave the team one editor for all ten, and halved their weight, while every page visitors read stayed exactly as it was.

Object record

EMYA edition archive, 2022 to 2026

Extent: 10 sites · 20 domains · EN / FR · ≈2,300 files
Owner: European Museum Forum
On arrival: Compromised; offline since 21 Aug 2026
Treatment: 21 Aug to 17 Sep 2026
Carried out by: Via Creativa

Status

Compromised≈ 5 Aug
Stabilised27 Aug
Static14 Sep

(01) · Key figures

The short version,in four numbers.

−0%

Archive weight, from 560 MB down to 269 MB

0of 0

Files changed by the move to new hosting

≈5GB

Of full-site backups taken off the public web

€0

Billed for hosting since the move

(02) · Chronology

Four weeks,in order.

Each date marks a point where the client could check the result live before the next step began.

≈ 5 Aug
Sites compromised (estimated from the evidence that survives)
21 Aug
The host locks all ten sites behind a password
27 Aug
Stabilisation complete; sites public again, content unchanged
28 Aug
French editions restored; the Safari brochure fault traced to its cause
4 Sep
Pre-migration audit passes; test deploy on Firebase
8 Sep
Client review fixes; broken brochures rebuilt from the InDesign originals
14 Sep
All 20 domains moved to Firebase Hosting
15 Sep
Code handed over on GitHub; content console live; Search Console set up
17 Sep
Archive weight halved; recrawl requested for the pages Google was missing

(03) · Condition report

Conditionon arrival.

A conservator writes a condition report before touching anything. Ours found three separate ways in, any one of which would explain the breach, and several faults that had nothing to do with the attack.

Found01

Full-site backups on the public web

Seven complete backup archives, about 5 GB, sat in a web folder anyone could download by guessing the file name. Each held the database password and every user's password hash. The oldest had been reachable since October 2022.

7 archives · ≈5 GB · since Oct 2022

Found02

Configuration anyone on the server could rewrite

On the four newest sites, the file holding the database credentials was writable by any process on the shared server: a takeover that needs no password at all.

4 newest sites · no password needed

Found03

File managers left installed

Five sites carried plugins giving full access to the server's files through the browser, all of them out of date.

5 sites · all out of date

Found04

Leftovers from other hands

Remote-management loaders, local-development helpers and maintenance files on every site. Logins belonged to a previous agency and to personal accounts; none belonged to the client.

every site · 0 client logins

Found05

Brochures blank on Apple devices

Two 2022 publications showed empty photo pages in Safari on Mac and iPhone, in 16 copies across 8 sites.

2 publications · 16 copies · 8 sites

Found06

French editions gone, search results anonymous

After the host restored a backup, the four French winners pages returned 404. Every site was titled simply “Emya”, with no description.

4 pages · 404 · titled “Emya”

What could not be known.

The host's logs reached back only to February 2026, so for most of the four-year exposure there is no forensic trail. We told the client that plainly instead of naming a single cause we could not prove.

(04) · Treatment

Five treatments,one rule.

Nothing a visitor reads was allowed to change unless the client asked for it. Every step was measured against a reference taken before it began.

T1Stabilisation21 to 28 Aug 2026

Close every way in,change nothing visitors see.

We worked site by site with the host's lock still in place. After every step we compared each homepage, character by character, against a reference taken before we started. All ten matched at every checkpoint, and the sites went public again on 27 August.

Plugins removed24
Leftover system files removed26
Exposed backup archives deleted7 (≈5 GB). The test link that served 665 MB now returns 404.
Database users rotated5, with 10 configuration files rewritten
Configuration file permissions0666 and 0644 → 0640 on all 10−0666rw-rw-rw-−0644rw-r--r--+0640rw-r-----
WordPress core7.0.2 → 7.1 on all 10, plus 46 themes
Security layer, all 10 sitesLockout after 5 failed logins for 60 minutes, firewall rules, in-browser file editing off
Shared logins10 replaced by 1 accountable admin
Credentials still valid from before0

Treated

French editions

The host's restore had wiped the language routing that lives in the database. Re-registering it took about 30 seconds per site, without changing a single setting.

≈30 s per site · 0 settings changed

Treated

Blank brochures in Safari

Three rounds of diagnosis, each tested on Apple's own rendering engine, ruled out the obvious suspects. The cause was 395 transparency masks an online PDF tool had laid over every page. We scanned all 81 PDF copies, 28 unique files, to prove only two publications were affected, then rebuilt both from the designers' InDesign originals: 96 and 27 pages, with 0.00% of pixels differing noticeably.

395 masks · 81 copies, 28 unique · 96 + 27 pages rebuilt

T2Relocation4 to 15 Sep 2026

Move ten sites to a homewith no doors to force.

WordPress was only ever needed to make these archives, not to serve them. We turned each site into plain files and moved them to Google's Firebase Hosting, in a project under the forum's own Google account. There is no database, no server code and no login page left for anyone to attack.

Pre-move audit11,406 internal links and assets checked, 0 missing · 107 redirect rules passing · 36 of 36 PDFs valid
Domains moved20, each site with and without www, certificates issued automatically
Email records touched0
Files compared byte for byte after a live redeploy2,317, 0 differences
French editionsNow real pages, so no restore can remove them again
Code and full historyIn the forum's own GitHub organisation

Files compared, byte for byte

0 / 2,317

Differences

One square per file, compared after a live redeploy

T3Access15 Sep 2026

One editor for all ten sites,signed in with Google.

Static sites are safe but hard to edit, so we built a content console for the forum's own subdomain. The team signs in with their Google accounts, and only named people get in. They edit inside each site's real design, see the result as they type, keep drafts hidden from visitors, and publish with one click.

Sites

Sections

≈0

Words

Content imported · English and French

What a publish changesOnly the pages that were edited. Everything else stays byte for byte, a guarantee tested on all 14 pages.
Replacing a photoOnce. Every size WordPress had generated is recreated and swapped automatically.
Running costAbout €0 a month
Passwords, licences, servers to patchNone

T4Findability15 to 17 Sep 2026

Make the archiveshow up in search again.

We verified the domain in Google Search Console and submitted a sitemap for every site. Then we inspected the 14 main pages one at a time. The 2026 editions were missing because Google's last visits, in May and July, had found a “do not index” tag left over from the lockdown. The live pages now allow indexing, and we asked Google to come back for the five it was missing.

Sitemaps read by Google11 of 11
Main pages already indexed9 of 14
Submitted for a fresh crawl5, confirmed in Google's priority queue

Main pages · 14

9 already indexed
5 submitted for a fresh crawl

Sitemaps read · 11 of 11

T5Weight17 Sep 2026

Half the weight,the same pictures.

Most of what visitors downloaded was print-grade material: brochures exported for a press, and photographs saved as PNG, a format that keeps every pixel. We capped photographs at 1,600 pixels, converted PNG photographs to JPEG and rebuilt the brochures at screen resolution. Before touching a single site, the client compared one photograph side by side. It went from 4.02 MB to 0.15 MB and looks the same.

One photograph, compared side by side

4.02 MB → 0.15 MB

Size of each site, MB

2022 Nominees59.4 → 47.1 · −21%
2022 Winners34.6 → 22.1 · −36%
2023 Nominees26.3 → 22.7 · −14%
2023 Winners51.6 → 35.5 · −31%
2024 Nominees111.7 → 36.7 · −67%
2024 Winners44.8 → 17.2 · −62%
2025 Nominees59.3 → 19.0 · −68%
2025 Winners45.9 → 17.7 · −62%
2026 Nominees74.2 → 28.2 · −62%
2026 Winners52.5 → 22.6 · −57%

All ten560.3 MB → 268.8 MB−52%

2024 Nominees brochure26.9 → 4.0 MB
2025 Nominees brochure21.0 → 3.3 MB
2026 Winners brochure34.0 → 10.6 MB
2022 Winners brochure17.1 → 7.3 MB
Images that now load only when scrolled into view995; the first four on each page still load at once
Asset links checked after the change2,001, 0 broken

(05) · Condition report

Conditionafter treatment.

The same archive, the same pages, on a completely different footing.

HostingBeforeTen WordPress installs on shared PHP hostingAfterStatic files on Google's infrastructure
Exposed to attackBefore10 login pages, 24 extra plugins, 5 database accountsAfterNo public login, no database, no server code
Who holds the keysBeforeA previous agency and personal loginsAfterThe forum's own Google, Firebase and GitHub accounts
EditingBeforeWordPress, one site at a timeAfterOne console for all ten sites
Archive weightBefore560 MBAfter269 MB
Brochures in SafariBeforeBlank photo pagesAfterRender correctly on every device
French editionsBefore404AfterPermanent pages
Hosting billBeforeShared hosting planAfter€0.99 of usage in the first 17 days, nothing billed

(06) · Method

Three rules borrowedfrom conservation.

Museums judge a treatment by how little it changes, how easily it can be undone, and how well it is recorded. We held the work to the same standard.

Minimal intervention

Change only what the task needs. Every page was measured before and after every step, and visitors never saw a change the client had not been told about.

Reversibility

Every change is one recorded commit that can be undone with one command. When a change was questioned, it was reverted within minutes and reapplied only after review.

Documentation

A technical log for each phase, a pre-migration audit, a rollback plan, a handover guide and a live status file, all stored with the client's code.

Via Creativa · Case study · September 2026 · Figures measured on the live sites and in the client's own consoles

Via Creativa

We rescue siteswithout breaking them.

Security, hosting and editing, fixed quietly and handed back to you with the keys. Let's talk about yours.

Start a project All work

Next case studyIZIA new web platform for a sport-for-social-change nonprofit.