Malware on the Checkout Page. 1,600 Customers Exposed.

The Incident

A manufacturer and retailer of sports equipment received a notification from its credit card payment processor: malware had been detected on the company's e-commerce website. The malware was a card skimmer, malicious JavaScript injected into a Magento CMS block, designed to capture and exfiltrate credit card information as customers entered it during checkout.

Every customer who made a purchase while the malware was active was potentially exposed.

The Response

Converge engaged IR panel vendors for digital forensics and legal consultation. Because credit card data was involved and card brands could require a formal investigation, Converge specifically selected a forensics firm that was also a PCI Forensic Investigator (PFI). This ensured the insured would be prepared if Visa, Mastercard, or other brands escalated the matter to a full PCI-DSS forensic investigation.

Having a PFI-qualified forensics firm from day one is a strategic choice. If a non-PFI firm conducts the initial investigation and a card brand later requires PFI-level work, the insured may have to start over with a new firm at additional cost. Converge's vendor selection avoids that.

The investigation confirmed three employee accounts were compromised, the likely vector for injecting the malicious code. A Converge panel vendor conducted data mining and determined that over 1,600 individuals needed to be notified. Notification and credit monitoring were coordinated through another panel provider.

The Outcome

The malware was removed and the e-commerce site was secured. Over 1,600 affected customers were notified and offered credit monitoring. The regulatory inquiry was addressed. Total cost came to approximately $66,000.

Key Takeaway

E-commerce platforms are high-value targets, especially CMS-based systems like Magento where a single compromised admin account can give an attacker access to inject code on every page. Patch regularly, restrict admin access, enable MFA, and consider web application monitoring that detects unauthorized script changes in real time. If credit card data may be involved, work with a PCI Forensic Investigator from the start.