Hackers Hijack Convertr Analytics Script to Skim Payment Card Data from Brazilian E‑commerce Stores

What happened

Hackers exploited CVE‑2026‑8467 in an outdated Plausible Community Edition instance hosted by Convertr, a Brazilian e‑commerce platform. After gaining access, they modified the analytics tracker that loads on every merchant checkout page, inserting JavaScript that captured payment‑card numbers, expiration dates, CVVs, cardholder names, and CPF IDs. The campaign was first detected on 24 Oct 2026 and targeted dozens of fashion retailers handling roughly R$2 billion in sales. Convertr removed the malicious script, upgraded Plausible, and began notifying merchants and payment providers. Researchers warned that browser caching could keep the skimmer active for up to 24 hours after cleanup.

Why it matters for trust and compliance

• The incident demonstrates the need for continuous oversight of third‑party software and proof‑of‑integrity controls, a control objective that satisfies multiple frameworks simultaneously.
• Implement continuous monitoring of third‑party script versions and hash verification to provide audit‑ready evidence of integrity.
• Strengthen vendor risk processes to ensure timely patching of shared components and reduce supply‑chain exposure.

Who is affected

Recommended actions

1. Audit all third‑party scripts for version and patch status; enforce subresource integrity where possible.
2. Deploy a monitoring solution that alerts on unauthorized changes to hosted assets.
3. Notify affected shoppers, advise cache clearing, and monitor for fraudulent transactions.