Hackers Exploit Convertr’s Shared Analytics Script to Harvest Credit‑Card Details

Security researchers have traced a recent wave of credit‑card theft to a compromised analytics script that powers checkout pages on the Convertr e‑commerce platform. By inserting malicious code into the shared script, a known skimming group was able to capture shoppers' payment information as it was entered, exposing thousands of consumers to fraud.

Convertr provides a suite of tools that help online retailers manage product listings, pricing and conversion tracking. One of its core components is a lightweight JavaScript analytics snippet that merchants embed on their checkout pages to monitor user behavior. Because the same script is served to all participating stores, a breach of the central file can affect every site that relies on it.

According to the investigation, the attackers gained unauthorized access to the script’s hosting environment and appended a short piece of code designed to read form fields containing card numbers, expiration dates and CVV codes. The stolen data was then silently transmitted to a command‑and‑control server operated by the skimming group. The technique mirrors other supply‑chain attacks where a trusted third‑party resource is weaponized to reach a broad audience without needing to compromise each individual merchant.

While the exact number of compromised transactions has not been disclosed, the breach raises immediate concerns for both consumers and merchants. Victims may see unauthorized charges on their statements, and retailers could face charge‑back fees, reputational damage, and potential regulatory scrutiny if they are deemed to have failed in protecting customer data.

Convertr issued a brief statement confirming that it is working with security experts to remediate the vulnerability and has taken the compromised script offline. The company is urging all merchants using its platform to replace the affected snippet with a clean version and to review recent transaction logs for signs of fraud. It also announced plans to implement stricter code‑signing and integrity‑checking mechanisms to prevent similar incidents.

The episode underscores a growing trend in cybercrime: attackers increasingly target the software supply chain, exploiting the trust placed in widely used third‑party services. Experts note that while traditional phishing and direct website compromises remain common, script‑based attacks can be especially damaging because they spread silently across many sites with a single point of failure.

Law enforcement agencies have been alerted, and a joint effort between security firms and financial institutions is underway to identify the perpetrators and trace the stolen data. In the meantime, consumer‑protection groups are advising shoppers to monitor their accounts closely, enable card‑issuer alerts, and consider using virtual card numbers for online purchases.

As the investigation continues, the incident serves as a reminder for online retailers to adopt rigorous third‑party risk assessments, enforce content security policies, and regularly audit the code that runs on their checkout pages. Strengthening these safeguards could help limit the reach of future supply‑chain exploits and protect both businesses and their customers from similar attacks.