Hackers Hijack Convertr Analytics Script to Skim Payment Card Data from Brazilian E‑commerce Stores
What Happened — A Brazilian credit‑card skimming gang compromised the Plausible analytics script that Convertr, a Brazilian e‑commerce platform, hosts for its merchants. The attackers appear to have leveraged CVE‑2026‑8467, an unauthenticated command‑execution flaw in an outdated Plausible Community Edition installation, to gain initial access to Convertr’s self‑managed server. They then injected malicious JavaScript into the tracker that loads on every checkout page of stores using Convertr. The skimmer harvested full payment‑card details (number, expiration, CVV, cardholder name) and the CPF taxpayer ID. The campaign was first observed on 24 Oct 2026 and targeted fashion retailers handling roughly R$2 billion in sales. Convertr removed the malicious code, patched Plausible, and began notifying affected merchants and payment processors. Researchers warned that browser caches could retain the script for up to 24 hours, so customers should clear caches before re‑shopping.
Why It Matters for Trust & Control Assurance — The incident highlights the need for continuous oversight of third‑party components and proof of integrity, a control area that maps to many compliance frameworks.
Who Is Affected — Retail/e‑commerce merchants using Convertr’s platform (Brazilian fashion brands) and their customers who paid by card.
Recommended Actions
- Verify that all third‑party scripts (analytics, payment, etc.) are sourced from patched, supported versions.
- Implement integrity‑checking (SRI, CSP, subresource integrity) and continuous monitoring of script hashes.
- Conduct a rapid cache‑clear communication to affected shoppers and monitor for fraudulent transactions.
- Review vendor risk processes to ensure timely patch management of shared services.
Source: BleepingComputer
Technical Notes
- Suspected exploit: CVE‑2026‑8467 (unauthenticated command execution in Plausible CE).
- Attack vector: vulnerability exploitation in a self‑hosted analytics component.
- Stolen data: payment‑card number, expiration, CVV, cardholder name, CPF.
Source: same article