Convertr supply chain skimmer stole payment card data from Brazilian checkouts

A Brazilian card skimming group tracked by Sansec since July 2024 appended a skimmer to the single Plausible analytics tracker file that every Convertr merchant checkout loads, in a supply chain attack detected on October 24, 2026. Convertr runs online stores and checkout for dozens of Brazilian fashion brands, with about R$2 billion in sales through the platform. From October 24 the skimmer stole card number, expiry, CVV, cardholder name and the CPF taxpayer number from checkout pages, and on October 26 it was updated to target Convertr's exact payment API fields. Sansec suspects, but has not confirmed, that the attackers exploited CVE-2026-8467 in Convertr's unpatched Plausible Community Edition 3.0 to 3.2.0 installation.

Convertr removed the skimmer and upgraded Plausible on October 27, and says it is notifying merchants, payment providers and authorities. Sansec warns that cached copies of the infected script could persist in browsers for up to 24 hours after the cleanup. No count of affected shoppers or merchants has been published, so this is a Cybersecurity item, not a Breaches add.

Sources: Sansec; BleepingComputer