Hackers hijack Convertr’s Plausible analytics script to siphon payment card data at checkout
On October 24, 2026, a card-skimming group modified the Plausible analytics script hosted by Brazilian e-commerce platform Convertr to steal payment data during checkout, possibly through a flaw in Plausible Community Edition. Anyone who paid on a checkout.convertr store since that date should block their card, and merchants should treat third-party analytics scripts as attack surface.
October 24, 2026. Security firm Sansec identifies a card-skimming campaign: the Plausible analytics script hosted by Convertr, a Brazilian e-commerce platform, has been modified to steal payment data during checkout. October 26, 2026. The attackers push a refined version of the skimmer, this time targeting the exact field names of Convertr’s payment API. October 27, 2026. Sansec confirms that Convertr removed the skimmer and upgraded Plausible to a patched version. The point that matters: for at least two days, every checkout on the stores hosted by Convertr — dozens of major fashion brands in Brazil — was silently loading a card-stealing script delivered by the analytics chain itself.
A supply chain hit where nobody looks: the analytics script
The mechanism is textbook Magecart, but its entry point is nastier than a store hack. The attackers did not compromise the merchants’ code. They modified the Plausible tracker file hosted on a self-managed server operated by Convertr — the very analytics script that every store on the platform already loads on its payment pages, in full trust.
That legitimate script is injected into the checkouts of all merchants using the platform. By hijacking it at the source, a single infiltration point reaches dozens of brands at once: the definition of a supply-chain attack. Sansec attributes it to a Brazilian gang active since at least July 2024, focused on infecting Magento, OpenCart, and WooCommerce stores.
A probable initial access point, not yet confirmed
Sansec suspects the attackers exploited an unauthenticated command-execution vulnerability in Convertr’s outdated Plausible Community Edition installation to gain initial access. The firm cites CVE-2026-8467, while noting that this vector has not been confirmed.
The nuance matters. Whether it was that exact CVE or another path, the lesson is the same: a self-hosted analytics script left unpatched becomes an entry point into every store that embeds it. Plausible, Matomo, and Umami have long been treated as “harmless” dependencies because they do not touch payment directly — but it is precisely because they load on the payment page that they are dangerous.
What the skimmer stole
The injected skimmer was configured to capture six fields on checkout pages: the card number, the expiration date, the CVV, the cardholder name, and the CPF — Brazil’s taxpayer identification number, a personal identifier whose resale compounds the damage.
The attack’s progression is documented by Sansec. Early versions used generic payment-field patterns. From October 26, 2026, the attackers pushed a more refined version targeting the exact field names of Convertr’s payment API. That is not a technical footnote: it is the sign of an attacker adapting the tool to the target, and therefore of a campaign that is professionalizing.
What to do if you paid on a Convertr checkout
Sansec’s advice is unambiguous. Anyone who paid by card on a store whose checkout address contained the string checkout.convertr since October 24, 2026 should contact their bank immediately and ask to block the card.
Two subtleties make remediation less simple than it looks. First, Convertr announced it was notifying affected merchants and payment providers — but the scale of the impacted customer base is not yet public. Second, Sansec warns that browser caching can keep the malicious script active on affected sites for up to 24 hours after cleanup: buyers should clear their cache before placing a new order, even once the threat is gone.
For buyers, the most robust protection remains a disposable virtual card that expires immediately after a transaction. It is the only defense that neutralizes skimming at the source, whatever the state of the loaded script.
Why analytics scripts are the new Magecart door
This attack is not an isolated accident. For several years, Magecart — the umbrella term for card skimming via injected JavaScript — has migrated from directly compromised stores to the third-party scripts those stores load. An advertising pixel, a chat widget, an A/B testing script, or an analytics tool: each is a small program running with the privileges of the payment page, and each can be modified upstream without the merchant ever touching its own code.
Regulators have absorbed this reality. PCI DSS version 4.0 requires, through requirements 6.4.3 and 11.6.1, that entities managing payment pages inventory their scripts and detect unauthorized modifications — typically by comparing integrity fingerprints. A self-hosted, unmonitored Plausible instance is exactly the scenario these requirements are meant to make impossible: a script loaded everywhere, rarely updated, whose content nobody checks.
What to do on the e-commerce side
For teams running an online store, this incident imposes three controls.
Inventory your third-party scripts. List every script loaded on the payment page — analytics, chat, A/B testing, advertising pixels. Each one is a potential injection vector, not a risk-free convenience.
Patch your self-hosted instances. An outdated Plausible Community Edition is the likely cause of the compromise. Apply patches the way you would for any exposed software, with the same priority.
Harden integrity. Use Subresource Integrity (SRI) when the script is served third-party, monitor changes to your analytics files, and restrict who can write to the server hosting them. A tracker file that changes for no reason is a warning sign.
Verdict
If you run an online store, treat your analytics scripts as a full supply-chain dependency: patched version, restricted write access, change monitoring, and SRI on third-party scripts. The cost is low; the surface covered is your entire customer base at its most sensitive moment. If you are a buyer who paid on a checkout.convertr store since October 24, 2026, block your card now and favor disposable virtual cards going forward. The lesson of Convertr extends well beyond Brazil: Magecart has not gone away — it simply changed entry points, and it is now knocking at the one door nobody locks, the analytics script loaded on the payment page.