Breach · · 3 min read
A card skimmer hid in the analytics script of Brazilian store platform Convertr
Researchers at Sansec say a skimmer in Convertr’s shared analytics script targeted card details and CPF numbers. Convertr says no store was affected. Here’s what to do.
Convertr runs online stores and checkouts for dozens of Brazilian fashion brands. Security researchers say someone slipped a card skimmer into an analytics file that every one of those checkouts loaded. Convertr disputes that any store was actually affected. If you shop at Brazilian online stores, here’s what each side says and what to do.
What happened
Sansec, a company that studies online store attacks, said on October 26, 2026 that a Brazilian card skimming group had added malicious code to the tracker served by Convertr’s own Plausible analytics server. Plausible is an open source alternative to Google Analytics. According to Sansec, the code switched on only on checkout.convertr pages and sent the card number, expiry date, security code, cardholder name and CPF (the Brazilian taxpayer number) to the attackers, in its research post.
Sansec says it first spotted the skimmer on October 24 and that the attackers updated it two days later to match Convertr’s payment fields. It suspects the way in was an old, unpatched Plausible install with a known flaw, but says it can’t confirm that without Convertr’s server logs. On October 27, Sansec confirmed the tracker was clean again, and BleepingComputer reported that Convertr had removed the code and updated the software.
In its official statement (in Portuguese) on October 27, Convertr said its investigation found no store was affected. It says the code could only run on a specific technical address that no store ever used as its checkout page, because each store’s payment page loads on the store’s own domain. Convertr says it removed the code and updated the analytics component as a precaution.
Nobody has published a count of affected stores or cards, so it’s not clear yet whether any card details were actually taken.
What this means for you
A skimmer copies what you type into a payment form as you type it, so the store itself can look completely normal. Sansec and Convertr disagree on whether real checkouts were exposed. Until that’s settled, the careful path is to treat a recent card payment on an affected checkout as possibly exposed.
What you can do
- Look at the address of the payment page if you paid by card on a Brazilian online store since October 24. If it contained
checkout.convertr, Sansec suggests asking your bank to block and replace the card. - Check your card statements for charges you don’t recognize, and turn on purchase alerts in your banking app.
- Watch for misuse of your CPF, such as accounts or credit applications you didn’t make.
- Use a virtual card for online shopping if your bank offers one, so a skimmed number can be shut off without affecting your main card.
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you give each store its own address, which makes a message to the wrong address an easy sign of a fake. Frame never collects or stores the leaked records themselves.
Sources
- Sansec, Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install, October 26, 2026, updated October 27, 2026
- BleepingComputer, Hackers hijack Convertr analytics script to steal payment card data, October 27, 2026
- Convertr, Nota oficial - Incidente de segurança no checkout da Convertr (in Portuguese), October 27, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.