Zero Radar
← feed
HighSecurity incidentupdated 27 Oct 2026, 20:57 UTC

Convertr analytics script hijacked to steal card data at checkout

Attackers reportedly altered a shared tracking script used by Convertr so it could copy shoppers' credit card details while they pay. Anyone entering card information on affected stores may be at risk.

Attacks reported (BleepingComputer)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy BleepingComputer, not officially confirmed yet
What to doCheck exposureCheck whether your checkout loads the Convertr analytics script and contact Convertr for guidance.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Skimming groupTargets payment card data at checkout
  2. 2Analytics scriptShared Convertr script is compromised
  3. 3Shopper browserScript runs on checkout page
  4. 4Card data copiedPayment details sent to attacker
  5. ResultShoppers' card data is stolen

What happened

A shared analytics script used by the Convertr e-commerce platform was reportedly compromised by a credit card skimming group, which used it to capture payment data during checkout.

Why it is dangerous: Shoppers' payment card data entered on affected checkout pages can be stolen, and merchants using Convertr may face customer losses and compliance problems.

Are you affected?

You are affected if your online store or checkout page loads the Convertr analytics script during payment.

Stores and checkout pages using the Convertr shared analytics script (versions unknown).

What to do

  1. Check whether your checkout pages load the Convertr analytics script and review it for unexpected code.
  2. Contact Convertr for confirmation of the incident and any clean script version or mitigation they provide.
  3. Notify your payment processor and customers if you believe card data may have been captured.

Timeline

  1. 27 Oct 2026, 20:57 UTC
    Publicly disclosed
  2. 27 Oct 2026, 20:57 UTC
    Reported by BleepingComputer · BleepingComputer
  3. 27 Oct 2026, 20:57 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-7477a331
Disclosed
27 Oct 2026, 20:57 UTC
On Zero Radar
27 Oct 2026, 20:57 UTC (1 min after disclosure)
Last change
27 Oct 2026, 20:57 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Convertr analytics script hijacked to steal card data at checkout · Zero Radar