Has anyone else using Webflow had clients report receiving emails claiming their website has been hacked and requesting ransom in bitcoin? We've had two clients report this issue in one morning. Any advice or insight would be greatly appreciated.

It sounds like you’re dealing with email-based extortion scams targeting clients whose websites are built on Webflow. These scams are widespread and usually not the result of an actual hack.

1. Nature of the Threat

• Extortion emails typically claim the website was hacked and demand Bitcoin payments.
• In most cases, no breach has occurred — it’s an attempt to scare clients into paying without verifying the claim.
• The scammers often get email addresses from public WHOIS records, contact forms, or website scraping.

2. Immediate Actions to Reassure Clients

• Inform clients that these emails are highly common and usually fake.
• Advise them not to respond or pay any ransom.
• Assure them that Webflow’s infrastructure is secure, and your team has seen no evidence of unauthorized access.

3. Recommend Best Practices

• Update website CMS passwords to strong, unique ones for extra precaution.
• Ensure two-factor authentication (2FA) is enabled on Webflow project accounts and CMS logins.
• Check form submissions in Webflow under Project Settings > Forms for any spam behavior.
• Advise clients to use domain privacy protection if their WHOIS records are public.
• Direct clients to report scam emails to the appropriate authorities (e.g., FTC, local cybercrime divisions).

4. Webflow’s Security Perspective

• Webflow-hosted sites run on AWS (Amazon Web Services) with enterprise-grade security.
• If a Webflow website actually had security issues, Webflow would notify the customer directly.
• Always stay updated via status.webflow.com for any platform-wide incidents (none are currently reported related to this).

5. How to Support and Educate Clients

• Provide them with a template message they can use to respond (or to inform colleagues) about the scam.
• Suggest using DMARC, SPF, and DKIM email authentication records if they manage their own email domains.

Summary

The emails your clients received are typical Bitcoin ransom/extortion scams and not the result of a breach of their Webflow sites. It's important to reassure clients, recommend basic security hygiene, and encourage them not to engage with or pay scammers. Always monitor Webflow's official communications for any real security updates.