Our client is a small UK-based e-commerce retailer specialising in high-end outdoor equipment. With 20 employees, the business relies entirely on online sales via a Magento 2 website and uses Stripe as its payment processor. The merchant had a clean history of compliance but lacked in-house cybersecurity expertise. (Client name protected for confidentiality.)
The Initial Alert:
The client was contacted by their acquiring bank after a card scheme raised a Common Point of Purchase (CPP) alert, linking a small cluster of fraudulent transactions to their website. No visible signs of compromise had been detected internally.
The Suspicion:
Due to the nature of the transactions and timeline, the card scheme required an Acquirer-Led Investigation (ALI) to determine whether the merchant environment had been compromised and whether cardholder data was at risk.
The Business Risks:
The acquiring bank formally referred the case to Foregenix as an ALI provider. The Cyber Defence Team contacted the merchant within hours and issued a clear evidence request covering web server logs, application codebase, admin access logs, and recent change records.
Our team performed source code analysis and log review on the client's Magento site. Within 24 hours, we identified a JavaScript skimmer injected via a third-party plugin that had not been updated in over a year. The skimmer selectively activated on the checkout page for non-admin users, avoiding internal detection.
The attack vector was linked to a vulnerable plugin that allowed unauthenticated file uploads. The attacker used this to plant malicious JavaScript code and exfiltrate cardholder data in real time to an external drop server.
We assessed the timeframe of the compromise, the volume of potentially exposed cardholder data, and the merchant’s cooperation. The final ALI report was delivered to the acquirer, confirming a confirmed compromise, detailing the data-at-risk, and recommending mitigation.
Compromise Confirmed: The attack was active for approx. 6 weeks before detection
Data-at-Risk Identified: All transactions during the compromise window were clearly defined
Rapid Containment: The malicious code was removed within 48 hours of ALI initiation
Remediation Implemented:
Outdated plugin removed and replaced
Admin credentials rotated
File upload restrictions enforced
Logging and change management enhanced
The merchant had no prior relationship with Foregenix, but chose to proceed with the investigation upon the acquirer’s recommendation due to our status as an approved Acquirer-Led Investigation provider. Foregenix’s speed of engagement, clear communication, and deep experience with Magento-based breaches stood out immediately. The Cyber Defence Team guided the client through a full review, mitigation, and restoration of trust with their acquirer and PSP.
Cyber Incident Response Experts | Fast & Reliable Services
Learn first-hand information about the latest events.