The client must have been hacked