Quickbooks Online issue

1046 Views 9 Replies 4 Participants Last post by medic17506, Oct 22, 2019

Nette1169

Discussion Starter · Oct 16, 2019

We are running QB online for a very small office. We recently found that some items in our inventory had been mysteriously deleted from our account. While investigating this, I found that nearly 350 inventory services or products were actually deleted in a matter of 5 to 6 minutes. I also found that several invoices had been deleted from our account two days prior to this within a short time frame of less than an hour. Some of the invoices that disappeared were from accounts that were being accessed to create new invoices. All of the missing invoices are sub-accounts to one parent account that was being worked on. Quickbooks support has not been much help as they say the only possibility is that the person that was logged in had to have deleted them. I do not believe they were deleted on Quickbooks end, but I also know they were not intentionally deleted by our employee. I also know there is no way physically possible for a person to delete 350 inventory items in under 5-6 minutes. The laptop we were using at the time was taken out of service approximately a week after this started for what we thought were other issues. That same computer had what appeared to be a hard drive failure 2 days ago, approximately 12 hours after installing a new antivirus program on it. (That's probably going to be my next thread

) So my questions are, does anyone know if it is possible for a virus to have caused the issues in Quickbooks Online? (This is the question I kept asking QB support, and the only response they would give me was "that's weird.") Are there any known vulnerabilities for QB online that we need to be aware of going forward that might allow viruses to access our data? (We thought it was safe in a cloud.)

Save

Status: Not open for further replies.

1 - 10 of 10 Posts

SeanLaurence

· #2 · Oct 16, 2019

That's weird.
First thing to do is change your passwords. Make sure the new passwords are strong.
Don't store the passwords on your PC. Write them down
Have you discussed recovering your data with QB support?
It is probably not worth doing however, as with that low volume of missing transactions could be re-entered more quickly than performing a restore.
Data restores on accounting systems can get messy if you have entered transactions after the backup date.

The thing you might have to be concerned about is a keylogger program (or device) installed on one of your PC's that you use to access QB Online. If the password keystrokes are sent to a bad actor, they would continue to be able to log into your Quickbooks even after you change your passwords. (Are you paranoid yet?)

Save

SeanLaurence

· #3 · Oct 16, 2019

It is entirely possible that there is a bug in QB online. If that were to be the case, it would be difficult for them to reproduce it or admit that the bug exists.

Save

Couriant

· #4 · Oct 17, 2019

The other thing that came to mind (I would be surprised if this is true) but perhaps there is a time limit or # amount of entries for invoices/inventory?

Save

Nette1169

Discussion Starter · #5 · Oct 17, 2019

SeanLaurence said:
That's weird.
First thing to do is change your passwords. Make sure the new passwords are strong.
Don't store the passwords on your PC. Write them down
Have you discussed recovering your data with QB support?
It is probably not worth doing however, as with that low volume of missing transactions could be re-entered more quickly than performing a restore.
Data restores on accounting systems can get messy if you have entered transactions after the backup date.

The thing you might have to be concerned about is a keylogger program (or device) installed on one of your PC's that you use to access QB Online. If the password keystrokes are sent to a bad actor, they would continue to be able to log into your Quickbooks even after you change your passwords. (Are you paranoid yet?)

Thank you for your advice. We will do the password changes.

I had researched the data recovery process prior to contacting QB support, so I already knew it was not possible for the invoices. The inventory can be made active again (it doesn't really delete that, just sets it to inactive.) The hard part is tracking numbers down to reset starting inventory. For 350 entries. The invoices will have to be re-entered. We have to have documentation of all transactions for tax purposes, and some of that inventory will have to be done before the invoices can be entered.

This is an extremely small business. There was one computer in use at the time, so any potential keylogging issues would have been were isolated to that system. When the new computer was purchased, this one was actually suppose to become the back-up/secondary computer for the busy hours of the day. So much for that now since the hard drive became a high dollar hockey puck the other day. However, I don't think it was a keylogger. I'm still inclined to believe this is virus related due to the rapid, mass destruction of inventory as well as the loss of the hard drive post antivirus install.

And nope, not paranoid. Especially since we have a new computer. With new antivirus protection.

See less See more

Save

Nette1169

Discussion Starter · #6 · Oct 17, 2019

SeanLaurence said:
It is entirely possible that there is a bug in QB online. If that were to be the case, it would be difficult for them to reproduce it or admit that the bug exists.

Ah yes, this is actually my greatest fear, and would make me a bit paranoid. We have had no further issues to date since the 2 incidents the last week of September. However, I will be monitoring this closely. And yeah, there was NO WAY they were going to admit in any way that this could be a QB problem. That part we shall have to see.

Save

Nette1169

Discussion Starter · #7 · Oct 17, 2019

Couriant said:
The other thing that came to mind (I would be surprised if this is true) but perhaps there is a time limit or # amount of entries for invoices/inventory?

There is a limit for some things, but we are very far from it. We have only been invoicing accounts through QB online since March of this year and we are a small company. We should be a few years out from needing an update. Thank you for that thought though.

Save

SeanLaurence

· #8 · Oct 17, 2019

I have no experience with Quickbooks online, but it strikes me as exceptionally unlikely that a virus on your PC would alter records on a QB online database. In order to do that, the attacker would have to assume you are on QB online, know your credentials, and write a program using the QB online API, which requires a number of steps to gain authority to access your data.

Have you been making local backups of your QB online data? If you have been, you may be able to extract your inventory levels from the backup file.

There is also an Audit log that you can review to see what might have happened to those missing records.

Save

Couriant

· #9 · Oct 17, 2019

Cloud services should be safe from viruses/malware providing you don't have an link to the data (like a mapped drive). Since this is a cloud based service, this shouldn't happen. I also don't use quickbooks online, so I cannot say what their policies are or how it functions, but I would start questioning their procedures for events like this.

Unless they can prove someone is deleting them, then it's going on them to figure it out. I assume everyone has their own login?

Save

medic17506

· #10 · Oct 22, 2019

@Nette1169 I am a QSP (QuickBooks Solution Provider) as well as a QB ProAdvisor - First thing you need to do is check the Audit Trail/Log...see instructions below - more info on this is here: https://quickbooks.intuit.com/learn-support/en-us/audit-log/learn-about-the-audit-log/00/186180

How do I access the audit log?
You need to have full access rights to access the audit log. Ask your master admin if you don't see it.

Go to Settings ⚙ and select Audit Log.
Select Filter.
Use the fields on the Filter panel to choose the appropriate User, Date, or Events filter to narrow the results.
Select Apply.

For most transactions or events, you can select View in the History column to open the Audit History, detailing changes to an individual transaction or event.

The audit log shows 150 records at a time. If you have more records, you can select Previous or Next to move between pages of records.

See less See more

Save

1 - 10 of 10 Posts

Status: Not open for further replies.

Top Contributors this Month