I did this a few times in the late '90s when I was a script kiddie eager to learn. I was naive enough to believe that I couldn't get in trouble that way. (I act

I did this a few times in the late '90s when I was a script kiddie eager to learn. I was naive enough to believe that I couldn't get in trouble that way. (I actually once got a job offer as a result.) From a security point of view the internet is a slightly more scary place these days though, with criminal gangs and governments being major threats. If it's just a nice kid you got lucky, and I would hire someone with a clue on security to thoroughly check your infrastructure at least once. But if it turns out to be a hook for something more nasty, you better get some serious help. Don't trust anything on that server anymore, and if you have other, similar servers running, suspect them to be compromised too. Also consider if you have any private (i.e. customer) data on that server that might get you in trouble if a third party has/had access to it. You can (re)install servers in seconds, but data is out there forever once leaked. PS: Did they obtain any SSH keys, or did you have password authentication enabled in the SSH configuration? (Don't do that!)