---
title: 'Convertr supply chain skimmer stole payment card data from Brazilian checkouts'
url: 'https://securteksecurity.com/news/convertr-plausible-supply-chain-skimmer-steals-payment-card-data'
markdown: 'https://securteksecurity.com/news/convertr-plausible-supply-chain-skimmer-steals-payment-card-data.md'
date: '2026-10-27'
description: 'A Brazilian card skimming group tracked by Sansec since July 2024 appended a skimmer to the single Plausible analytics tracker file that every Convertr merchant checkout loads, in a supply chain attack detected on October 24, 2026. Convertr runs online stores and checkout for dozens of Brazilian fa…'
taxonomy:
  category:
    - Cybersecurity
---

# [Convertr supply chain skimmer stole payment card data from Brazilian checkouts](https://securteksecurity.com/news/convertr-plausible-supply-chain-skimmer-steals-payment-card-data)

   27th Oct 2026  

A Brazilian card skimming group tracked by Sansec since July 2024 appended a skimmer to the single Plausible analytics tracker file that every Convertr merchant checkout loads, in a supply chain attack detected on October 24, 2026. Convertr runs online stores and checkout for dozens of Brazilian fashion brands, with about R$2 billion in sales through the platform. From October 24 the skimmer stole card number, expiry, CVV, cardholder name and the CPF taxpayer number from checkout pages, and on October 26 it was updated to target Convertr's exact payment API fields. Sansec suspects, but has not confirmed, that the attackers exploited CVE-2026-8467 in Convertr's unpatched Plausible Community Edition 3.0 to 3.2.0 installation.

Convertr removed the skimmer and upgraded Plausible on October 27, and says it is notifying merchants, payment providers and authorities. Sansec warns that cached copies of the infected script could persist in browsers for up to 24 hours after the cleanup. No count of affected shoppers or merchants has been published, so this is a Cybersecurity item, not a Breaches add.

Sources: [Sansec](https://sansec.io/research/convertr-plausible-supply-chain-attack); [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [Compromised ConnectWise Cloud Backup credential used to sign in to 173 Microsoft 365 tenants](https://securteksecurity.com/news/connectwise-cloud-backup-credential-173-microsoft-365-tenants.md)
- Next: [CoreWeave debt trades at distressed levels as AI financing is repriced](https://securteksecurity.com/news/coreweave-debt-trades-distressed-ai-financing.md)