The Convertr Skimmer: How a Hacked Analytics Script Reached Every Checkout

Security firm Sansec reports that attackers added a card skimmer to one analytics script on Convertr's own tracking server. Every Convertr checkout loaded that script, so every checkout sent card details to the attacker from October 24, 2026. No store page was edited, and the script's web address never changed.

That second detail is the one worth building a habit around.

What happened at Convertr?

Convertr runs the online stores and checkout for dozens of Brazilian fashion brands. Sansec says Convertr states that its merchants have sold more than R$2 billion, about 320 million euros, through the platform. All of those checkouts load a tracker from Convertr's own analytics server (Sansec, October 26, 2026).

Sansec detected a skimmer in that tracker late on October 24 (UTC). It only ran on checkout pages. It read the card number, expiry, CVV, cardholder name and the buyer's CPF, the Brazilian taxpayer number, and sent them to a server the attacker controls when the shopper placed the order.

Two days later the attackers updated it to target the exact field names of Convertr's payment system. On October 27, Sansec reported that Convertr had removed the skimmer and patched the analytics software, and that Convertr said it was notifying merchants, payment providers and the authorities. Sansec also said Convertr had not responded to its first notice before publication.

How did a trusted analytics script become a skimmer?

By being changed at the source. Convertr runs the open-source analytics tool Plausible on its own server, which serves the tracker straight from a file on disk. Whoever can change that file changes the script every store loads.

Sansec suspects the way in was CVE-2026-8467, a critical flaw in Plausible Community Edition versions 3.0.0 through 3.2.0 that lets anyone run commands on the server without logging in. Plausible fixed it in May 2026, and Sansec says Convertr installed version 3.0 in 2025 and never updated it. Sansec has not seen Convertr's server logs, so the entry point is a suspicion, not a confirmed finding.

The group behind it has been tracked since July 2024. Until now it broke into stores one at a time. Sansec says this is the first supply chain attack it has seen from it. For background on the pattern, see what a supply chain attack is.

Why wouldn't a list of domains catch this?

Because the domain was already on the list. The checkouts had loaded a script from Convertr's analytics server all along. After October 24 they loaded one from the same address, and the file behind it was different.

A check that only asks "which domains does this page load from?" sees no change. A check that asks "is this the same file as last week?" does. That is a different question, and it is the one this incident turns on.

Could this happen to a store outside Brazil?

The method can, even though this group mostly does not. Sansec says the group has infected dozens of stores on Magento, OpenCart and WooCommerce, almost all in Brazil. The victims here were Brazilian and the stolen data included the CPF.

But nothing in the technique is local. Changing a script file on a server your checkout loads works on any checkout, in any country. Analytics, chat widgets, review apps, tag managers and anything else loaded from someone else's server is exposed to the same kind of change. We covered how a third-party script becomes a skimming risk earlier, and this is a live example of it.

What should a store owner check this week?

Five things, none of which need a security team.

1. List what your checkout loads, by domain, and note which ones are run by a third party. The audit guide takes about fifteen minutes.
2. Ask each vendor how their script server is kept up to date. Include your platform and agency, because a script that looks like part of your store may be served from theirs.
3. Compare the files, not only the domains. Save a fingerprint of the key scripts and check it weekly. Here is what to watch and how often.
4. Check your browser security settings. A content security policy that lists where the browser may send data should refuse a send to an unlisted domain, as long as it is enforced and not report-only. This explains how to read that setting.
5. Tell your payment processor if anything on your checkout looks wrong. They will want to hear about suspected card theft.

What if you run your own analytics, like Plausible?

Then it is your server to patch, and an out-of-date one is the weak point here. Sansec's advice for Plausible Community Edition is to upgrade to 3.2.1 or later and search your access logs for requests to /storybook.

If you find any, Sansec says to rebuild the server, rotate its secrets, and compare the files in its tracker folder with the official release. The same logic applies to any self-hosted tool your checkout loads a script from.

Keep watching after the first check

A one-off check shows you what your checkout loads today. It cannot show you that a file you trusted last week is not the same file now.

This is your store today. App updates, theme edits and new agency work change it, usually without anyone telling you. Run a free check, verify your domain, and keep it running.

Sources: Sansec, "Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install," October 26, 2026 (updated October 27).