Hackers hijack Convertr analytics script to steal payment card data
Hackers hid malicious code in a single Convertr analytics file loaded on the checkouts of dozens of Brazilian fashion brands. According to Sansec, which found the case, the code has copied card number, expiry, CVV, cardholder name and CPF since October 24, and the infected file was still online. Shoppers should watch statements, block and replace cards, and monitor their CPF.
What happened
Hackers hid malicious code in a web analytics file hosted by Convertr, a Brazilian platform that runs the online stores and checkouts of dozens of fashion brands. The code copies card number, expiry, CVV, cardholder name and CPF from shoppers. Sansec discovered the case; the code has been live since October 24.
Why it matters
Every customer who paid at these checkouts since October 24 may have had full card data and CPF copied, enabling financial fraud and misuse of the CPF. The brands face chargebacks, loss of trust and responsibilities over payment data. Convertr did not reply to Sansec's notice and had made no public statement, extending the exposure.
What to do
Check whether your company or suppliers use Convertr checkout (address containing checkout.convertr) and treat it as compromised until cleanup is confirmed. Tell customers who bought since October 24 to call their bank, block and replace the card, and watch for misuse of their CPF. Demand an official statement from Convertr.
For the technical team
- Affected
- Plataforma Convertr (script de analytics), que opera a loja online e o checkout de dezenas de marcas de moda brasileiras · Convertr platform (online store and checkout). Dozens of Brazilian fashion brands using the platform; names not listed in the sources.
- Exploitation
- Active exploitation. The code has been live since October 24 and, according to Sansec, the infected file was still online the morning of disclosure. The number of affected shoppers is not yet known.
- Fix
- No fix or clean version cited in the sources. Sansec notified Convertr and received no reply; as of the coverage, Convertr had said nothing publicly.
- Vector
- Component: a single web analytics file hosted by Convertr and loaded on every checkout of the platform. Flaw: attacker-inserted code inside that file. Exploitation condition: none beyond shopping; the attackers did not need to breach each store individually.
- More details
- Discovery attributed to Sansec, a Dutch e-commerce security company. According to Sansec, the group is Brazilian and has been monitored since July 2024. Timeline: code live since October 24; incident opened October 27, 2026; BleepingComputer coverage on October 27.
Timeline
BleepingComputer coverage details that attackers hijacked Convertr's analytics script to steal payment card data.
Incident opened.
Sources 2 sources
- @namcios @namcios
- @BleepinComputer @BleepinComputer
