October 24–27, 2026: card-skimming code was injected into the checkout pages of merchants that use Convertr, a Brazilian e-commerce platform. Researchers at Sansec identified the campaign on October 24, and BleepingComputer reported it on October 27. Canonical: convertr-checkout-skimmer2026. Primary reporting: BleepingComputer.
Convertr runs online stores and checkout systems for fashion brands and other merchants in Brazil. According to BleepingComputer, it handles about R$2 billion (roughly $370 million) in sales. Because the skimmer sat in a script that every merchant on the platform loads, one compromise reached all of them at once. The shops' own code can be clean while a shared dependency is not, which is what makes this kind of attack hard to see from the merchant side.
What happened
- Entry point (suspected): attackers modified an analytics tracker file on a self-managed server that Convertr operates. The tracker is based on Plausible, an open-source analytics tool. Sansec suspects an outdated Plausible Community Edition install was exploited through CVE-2026-8467. That is unconfirmed.
- Injection: the modified tracker loaded a skimmer on the checkout pages of every merchant using the platform.
- October 24: Sansec identified the campaign.
- By October 26: the skimmer had been refined. Early versions used generic payment-field patterns; the later one targets Convertr's exact payment API field names.
- October 27: BleepingComputer published its report.
Verified and unverified
- Verified (researchers): the modified tracker and the injected skimmer, as analysed by Sansec and reported by BleepingComputer.
- Company (relayed, not direct): Convertr did not respond to BleepingComputer's request for comment. Sansec reports that Convertr removed the skimmer, upgraded Plausible to a patched version and is notifying affected merchants and payment providers. BreachHistory has not seen a direct Convertr statement.
- Unverified: the CVE used for entry, the number of merchants affected, the number of shoppers, and the number of card numbers captured.
What data was targeted
The skimmer targets what is typed into a checkout form: card number, expiry date, CVV, cardholder name and CPF, the Brazilian taxpayer number. A card number with its CVV is enough for many online purchases, which is why the first advice is to block the card rather than wait for a fraud alert.
Who is at risk
- Shoppers who paid by card on a Brazilian online store using Convertr's checkout since October 24, 2026.
- Merchants on Convertr, whose checkout pages carried the script.
- Payment providers that process those transactions.
What to do
- If you paid by card on an affected store since October 24, contact your bank now, ask it to block the card and issue a replacement, and review recent statements for unfamiliar charges. Researchers advise this step.
- Turn on transaction alerts with your card issuer so that purchases are reported as they happen.
- Merchants: ask Convertr in writing to confirm that the skimmer is removed, that the analytics component is patched, and which of your checkout pages loaded the affected script. Audit your checkout for third-party code you did not add.
- Anyone running self-hosted analytics: patch on a regular schedule, restrict admin access, and monitor tracker files for changes.
Reference links
Sourcing note: the technical details come from Sansec's analysis as reported by BleepingComputer. Convertr's own statement was not retrieved, and the merchant and card counts are not published.