{"id":53550,"date":"2016-10-20T11:16:20","date_gmt":"2016-10-20T18:16:20","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=53550"},"modified":"2025-08-15T02:51:02","modified_gmt":"2025-08-15T09:51:02","slug":"magento-hack-2016","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/magento-hack-2016\/","title":{"rendered":"Leading E-Commerce Platform Magento Cracked by Cybercriminals"},"content":{"rendered":"

There\u2019s a modern joy we\u2019re all too familiar with. We\u2019ve all made an online purchase while reclining in pajamas, computer on our lap. Everyone knows the comfort of simply punching credit card numbers into a website for a new item. That\u2019s what we do for Converse shoes, Audi accessories, and even donations to political parties. But one dark element turns convenience into fear. Such transactions also attract the buzz of cybercriminals. Just recently, roughly 6,000 online shops \u2014 including those mentioned above, as well as the National Republican Senatorial Committee \u2014 have had user payment details stolen<\/a>.<\/p>\n

Such a large attack isn\u2019t easy to pull off. To do so, perpetrators targeted something many e-commerce websites have in common: Magento. Don\u2019t worry if you haven\u2019t heard that name before. Simply put, Magento is a service that supports many e-commerce stores. Think of it this way: fashion designers or politicians may be experts in clothing trends or policy-making, but they\u2019re not familiar with technical aspects of online selling. By using Magento, they can build websites, manage orders, and analyze business data.<\/p>\n

Now, here\u2019s what\u2019s crucial. Magento also processes payments for, and runs on, around 250,000 websites<\/a>. That\u2019s exactly what cybercriminals are after: a chance for looting at such scale!<\/p>\n

Cyber crooks, over the past six months, have been siphoning credit cards from websites that use Magento. And these aren\u2019t your run-of-the-mill attacks. Rather than going after a company\u2019s database, they\u2019ve used malicious code to forward card details<\/a> during the actual transactions made on Magento-hosted systems. Once you submit those digits, an illicit underground market obtains them. Disguising their efforts further, perpetrators even used stenography to hide data within image files<\/a>, so security teams wouldn\u2019t notice. All in all, these sophisticated actions made a recipe for many stolen cards.<\/p>\n

To put this into perspective, big names such as Audi, Converse, and the National Republican Senatorial Committee were all among the 6,000 affected websites. To be clear, the victims either used an out-of-date version of Magento or lacked in prevention efforts, which made them vulnerable to hacking. But this attack still highlights the risks of buying things online from insecure platforms. With global e-commerce accounting for $1.915 trillion this year, and projected to reach $4 trillion by 2020, we\u2019re not likely to see the end of such attacks anytime soon.<\/p>\n

And let\u2019s be honest. Nobody is likely to head to a brick-and-mortar shop for every single purchase, in this digital day and age. Unless we get thrown into a time machine, the comfort and convenience of clicking away in our pajamas is simply too irresistible. So it\u2019s not a matter of avoiding online shopping, but doing so safely.<\/p>\n

Tips to Keep In Mind For Your Next Online Purchase<\/h2>\n

The good news? That\u2019s possible. Here\u2019s are a couple tips to keep in mind for your next online purchase:<\/p>\n