Hanna Anderson, a company that offers children’s clothes online, has been the target of a Magecart attack wherein their customers’ credit card information was stolen as they were making purchases. The attack was discovered after the credit cards were found for sale on the dark web.
Magecart is a simple bit of code that is sophisticatedly injected into websites to steal credit card information and most of the time unknowing to the website organization. It is important for organizations that use e-commerce websites with third-party connections or plugins to verify that they are up to date with all known patches and software. Hackers will leverage this information by sending phishing emails to the victims pretending to offer services using fear or curiosity to get them to click a link or open an attachment.
Organizations will want to restrict third-party vendors’ access to sensitive data, like credit card data, names and home address. Having a robust third-party policy to restrict external access to sensitive information and only allowing verified code or scripts to be executed can greatly reduce exposure. In the unfortunate event that a breach does occur, the attacker’s opportunity to access data is greatly reduced.
Customers should pay extra attention to emails sent to them regarding the Hanna Andersson / Salesforce Commerce Cloud breach and monitor their credit accounts for any suspicious activities and close any account for any transactions they do not recognize.
We need to call these attacks what they are: digital supply chain attacks. Some attacks use the same or similar code as Magecart, but a far greater number use a wide array of advanced techniques to redirect online shoppers and readers.
Until companies take the insecurity of their digital supply chains seriously and monitor the code that runs on their sites, these attacks will continue. There\’s no other way to prevent these attacks than to allow only trusted digital vendors to run code on your site, as well as closely watch and regulate all the code that these vendors and their own digital third parties run to make sure they all follow your policies. By doing so, they will address not only security risk, but also quality and performance risks that can degrade their site’s user experience.
Many websites, especially retailers, are suffering from Magecart-like attacks as hackers evolve the malware in an effort to steal credit card information on the web. With these continuous attacks, customers should check their credit card statements regularly or apply for a new one right away if theirs’ has been compromised. Once stolen, these card numbers are sold on the dark web for future fraudulent purchases. Companies can mitigate fraudulent transactions by identifying customers through their online behavior instead of relying on credentials or credit card numbers. This method allows companies to block transactions from credit cards that have been stolen.