There could be a serious problem

Have they shown you any of your server files?

1 server file from our donation system

Who is the person threatening?

https://imgur.com/PWK1UM5

According to him, some unknown hacker, learned how to download the server part using rlib.

He says this hacker is a friend of his and he demands $100 from me for nothing to happen.

I'm ready to pay him, but I think it's not a guarantee that he won't do something bad.

I will write a statement to the police in a blackmail case, but it seems to me that the police will simply ignore me..

I can translate all correspondence with him into English and send it here

And you're 100% sure they have more than just this one file? That one file definitely couldn't just be ripped from a leak?

I am not 100% sure, that's why I created this post to ask the forum if there is a real leak in this library.

I am confused and do not know how to do the right thing.

I reacted instantly - the library itself was immediately removed, the server cache was cleaned, SteamAPI was changed, all passwords to the databases of each server were changed and FTP passwords were changed.

Even if he's being serious, don't pay him.

Blackmail always follows the same pattern. If you give, they will just come back wanting more. If you find out that the case is an exploit in an addon provided here on gmodstore (Or in this case, a dependency of it), I see no reason for gmodstore to ban you for them leaking addons you got from here. And if you have custom content, you might just need to bite the bullet and take the loss. Maybe attempt to DMCA anywhere they upload it.

Thank you, I will follow all the instructions you give here, for me it is very important, because of these crooks my eye is already twitching.

By the way, they also got all the IP addresses of the players via rlib and ddos attacked the administrators.

rlib is Richard's library, so it might be worth of him being aware of this.

I've never used rlib before so idk how it works, but from a very quick look at it's docs, idk how it could be used to steal server files. Again, never used rlib before, no idea how it works. Could just be looking over something in it's docs, but it seems to me like a very weird issue.

Does this mean that their threats are highly likely to be true?

Is this donation system you use custom?

Yes, they showed the file with the secret key that was used to confirm payments.

Just asking to be sure: This file is not being sent to the client? (Not added via AddCSLuaFile and not in the lua/autorun/ folder)

No, this file is not sent by us in any way. 

Sorry, luckily someone tagged me. Hadn't heard otherwise. Obviously with or without proof, I'm going to take this serious. I've reached out to you via DM to ask you questions to investigate this further, so if you could touch base with me, I want to just double confirm if they are actually on to something, or just toying with you.

Okay, i am ready to go right now.

After much investigation, we found that many projects were affected, it was not about rlib, sorry I believed the hackers and said it could be about rlib, in fact, the problem is in the engine itself, and it affects any server, in fact we saw how the affected 11 projects, 7 of which paid hackers ransom, we collected a lot of information wrote a report Rubat, not sure whether today's update includes a fix for this problem or not, but I hope so, because because we still do not know how they did it all, in addition to downloading builds servers, they have managed to delete files from the servers, for this server owners, update your server and be vigilant, I hope that the new update will solve the problem..