Convertr analytics script hijacked to skim shoppers' card data
Shoppers who paid by card on affected Convertr-powered stores since October 24 are advised to contact their banks and clear browser caches.
Brazilian e-commerce platform Convertr, which powers checkout for many major fashion brands, had its analytics tracker tampered with by a card-skimming group that has been active since at least July 2024. Sansec reports the attackers altered a Plausible tracker on a server Convertr manages, and suspects an unauthenticated command-execution flaw in an outdated Plausible Community Edition install was the entry point, though this is unconfirmed. By October 26 the skimmer was refined to target Convertr's own payment field names, harvesting card numbers, expiry dates, CVVs, cardholder names and CPF tax IDs. Convertr has since removed the skimmer and patched Plausible, and says it is notifying affected merchants and payment providers. Shoppers who paid by card on affected stores since October 24 are advised to contact their banks, and to clear browser caches because the script may linger for up to 24 hours.
Why it matters
The breach shows that a third-party analytics script running on a checkout page can be turned into a card-theft tool without the shopper seeing any change. For the many fashion brands that rely on Convertr for payments, the compromise means their customers' card numbers, expiry dates, CVVs, names and CPF tax IDs may have been exposed during the period the skimmer was active. Because the attackers tuned the skimmer to Convertr's own payment field names, the attack was aimed at this platform specifically rather than at any single store. The story is a reminder that the security of a checkout depends on every script it loads, including tools that look harmless, such as analytics trackers.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.