Hackers hijack Convertr’s Plausible analytics script to siphon payment card data at checkout

On October 24, 2026, a card-skimming group modified the Plausible analytics script hosted by Brazilian e-commerce platform Convertr to steal payment data during checkout, possibly through a flaw in Plausible Community Edition. Anyone who paid on a checkout.convertr store since that date should block their card, and merchants should treat third-party analytics scripts as attack surface.