pukka

I have many years of web development and security expertise but no special skills are needed to read a Google search result.

Since you're questioning my motives, know that my first action was to call CR.net and notify them. My second was to be proactive in protecting customers who might be impacted. This is a small community after all. After going undetected for 4 months, it would be a rookie mistake to call "all good" without a detailed investigation so I'm waiting to see if we need to take further action. I'm sure that information will be forthcoming.