2026 Convertr — Brazilian checkout platform hijacked; card-skimming script served to merchant checkouts (number of shoppers not published)
Data compromised
Card number, expiry date, CVV, cardholder name and CPF (Brazilian taxpayer ID) entered at checkout on affected merchants from at least October 24, 2026. Counts of merchants, shoppers and cards have not been published.
Technical writeup
Sansec identified the campaign on October 24, 2026; the skimmer was refined by October 26 to target Convertr’s exact payment API field names. BleepingComputer says the gang has been active since at least July 2024. Convertr did not respond to BleepingComputer. Its statement that it removed the skimmer, upgraded Plausible and is notifying merchants and payment providers is as relayed by Sansec. companyConfirmed true reflects that relayed acknowledgment, not a direct statement.
Root cause
Attackers modified an analytics tracker file on a self-managed server operated by Convertr. The tracker loads on checkout pages of every merchant on the platform and injected a skimmer. Sansec suspects an outdated Plausible Community Edition install was exploited (CVE-2026-8467); this is unconfirmed.