Comments On The Hanna Anderson Magecart Attack

Hanna Anderson, a company that offers children’s clothes online, has been the target of a Magecart attack wherein their customers’ credit card information was stolen as they were making purchases. The attack was discovered after the credit cards were found for sale on the dark web.

Experts Comments

January 22, 2020
James McQuiggan
Security Awareness Advocate
KnowBe4
Magecart is a simple bit of code that is sophisticatedly injected into websites to steal credit card information and most of the time unknowing to the website organization. It is important for organizations that use e-commerce websites with third-party connections or plugins to verify that they are up to date with all known patches and software. Hackers will leverage this information by sending phishing emails to the victims pretending to offer services using fear or curiosity to get them to.....Read More
Magecart is a simple bit of code that is sophisticatedly injected into websites to steal credit card information and most of the time unknowing to the website organization. It is important for organizations that use e-commerce websites with third-party connections or plugins to verify that they are up to date with all known patches and software. Hackers will leverage this information by sending phishing emails to the victims pretending to offer services using fear or curiosity to get them to click a link or open an attachment. Organizations will want to restrict third-party vendors’ access to sensitive data, like credit card data, names and home address. Having a robust third-party policy to restrict external access to sensitive information and only allowing verified code or scripts to be executed can greatly reduce exposure. In the unfortunate event that a breach does occur, the attacker’s opportunity to access data is greatly reduced. Customers should pay extra attention to emails sent to them regarding the Hanna Andersson / Salesforce Commerce Cloud breach and monitor their credit accounts for any suspicious activities and close any account for any transactions they do not recognize.  Read Less
January 22, 2020
Mike Bittner
Associate Director of Digital Security and Operations
The Media Trust
We need to call these attacks what they are: digital supply chain attacks. Some attacks use the same or similar code as Magecart, but a far greater number use a wide array of advanced techniques to redirect online shoppers and readers. Until companies take the insecurity of their digital supply chains seriously and monitor the code that runs on their sites, these attacks will continue. There's no other way to prevent these attacks than to allow only trusted digital vendors to run code on your .....Read More
We need to call these attacks what they are: digital supply chain attacks. Some attacks use the same or similar code as Magecart, but a far greater number use a wide array of advanced techniques to redirect online shoppers and readers. Until companies take the insecurity of their digital supply chains seriously and monitor the code that runs on their sites, these attacks will continue. There's no other way to prevent these attacks than to allow only trusted digital vendors to run code on your site, as well as closely watch and regulate all the code that these vendors and their own digital third parties run to make sure they all follow your policies. By doing so, they will address not only security risk, but also quality and performance risks that can degrade their site’s user experience.  Read Less
January 22, 2020
Robert Capps
VP
NuData Security
Many websites, especially retailers, are suffering from Magecart-like attacks as hackers evolve the malware in an effort to steal credit card information on the web. With these continuous attacks, customers should check their credit card statements regularly or apply for a new one right away if theirs’ has been compromised. Once stolen, these card numbers are sold on the dark web for future fraudulent purchases. Companies can mitigate fraudulent transactions by identifying customers through.....Read More
Many websites, especially retailers, are suffering from Magecart-like attacks as hackers evolve the malware in an effort to steal credit card information on the web. With these continuous attacks, customers should check their credit card statements regularly or apply for a new one right away if theirs’ has been compromised. Once stolen, these card numbers are sold on the dark web for future fraudulent purchases. Companies can mitigate fraudulent transactions by identifying customers through their online behavior instead of relying on credentials or credit card numbers. This method allows companies to block transactions from credit cards that have been stolen.  Read Less
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Share on facebook
Share on twitter
Share on linkedin

Recent Posts

Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics

Twitter Facebook-f Linkedin Youtube

Working With Us

The Pages

Our Contributing Experts