At last, we’ve resolved the PayPal issues with the website and you can now renew your membership. We’re terribly sorry for the mass inconvenience caused by this outage that lasted almost two full months. That’s the short of it, keep reading for the long version of the saga.

On July 9, 2026, the IPMS Canada website was attacked. I don’t believe it was done by anyone with a particular grudge against us, in that it appeared to originate from Indonesia. The goal of the hack was to redirect our traffic away to sites selling crypto – in an attempt to harvest money and/or information.

Our website was, essentially, completely replaced with a malicious one. As soon as I found out about this I took it down, which is where the initial complete outage came from. Over the span of about a week I was able to restore the site from a backup, and that’s what you see today.

One thing needs to be perfectly clear: Because we use PayPal, we never see or store any of your payment information. Due to that, there was none to steal on the website. The attackers may have gotten some names and addresses from recent orders, but that’s the limit of it. And I doubt any of that information would be useful to anyone – names and addresses are already public information, and if you got a message saying your IPMS account had been ‘locked’, I’d hope everyone would realize that to be what it was… Junk.

So why did it take so long to get the site back into operation? Well, in short – PayPal. The IPMS Canada site had been running on a ‘regular’ PayPal account for many years. The software we’d been using to integrate with PayPal (we use WordPress to run the site) had gotten old and become unsupported some time ago. To move to the newer version of this, we would need a ‘business’ account with PayPal, and I suppose we just never did that as we weren’t set up as a business. But now I wanted to move to the new software as what we were using was a potential entry point for hackers. For anyone interested in how the hackers got in, it was through a small utility plugin named “Quick Page/Post Redirect” that had been tainted by the people that created it. (CVE here for those interested.) The plugin worked fine for years on hundreds of thousands of sites, and then an update included a backdoor, and I believe that’s how we got taken over.

Back to PayPal, in order to have a business account we needed to be set up as a business. We weren’t, so our National Director, Chris Wheeldon, made that happen. We are now, legally, the “International Plastic Modellers Society of Canada”, a Canadian not-for-profit corporation, with all that comes with it.

Once that was done, it took a couple weeks to actually get the account set up with PayPal. I think we can blame increased scrutiny to prevent money laundering for the number of hoops that had to be jumped through, but eventually we did make it through.

So it’s all back up and running and, again, my apologies. As it sits now, the site is clean. In the coming months we’re going to be looking at changing the platform we run the site on. It’s a new world out there with AI doing automated hacking, and we want to provide more to our members – like a digital membership option. The new platform will let us do those things. More details to come on that.

Please go renew your IPMS Canada membership as soon as you can. We’re sitting on a batch of RT’s that are just itching to get out the door, and we don’t want to have to warehouse them any longer than we have to.

You can renew here: https://www.ipmscanada.com/product/ipms-canada-membership/

Daryl Dean
IPMS Canada Webmaster