Hackers Hijack Convertr Analytics Script to Steal Payment Card Data

A sophisticated credit card skimming group has successfully compromised a shared analytics script used by the e-commerce platform Convertr to harvest shoppers' payment data during checkout.

According to reports from BleepingComputer, attackers injected malicious code into the legitimate script, allowing them to silently capture sensitive financial details like credit card numbers and CVV codes as users finalized their purchases.

This type of supply-chain attack targets third-party dependencies and analytics tools integrated into websites, often bypassing traditional security measures because the malicious code executes directly within the user's browser.

The incident serves as a stark reminder of the risks associated with third-party vendors and the critical need for e-commerce operators to strictly monitor and audit all external scripts running on their checkout pages.

For the global digital commerce ecosystem and growing tech markets, this breach highlights the persistent threat of digital skimming and the importance of robust defense mechanisms against third-party compromises.