Muppets And Others Become Victims Of Data Skimming Attack

Sesame Street Live! and an estimated 20,000 other online stores were recently the focus of a massive data skimming effort. The attack was perpetrated on Volusion, a major software platform providing e-commerce and shopping cart service support for more than 180,00 merchants worldwide. Magecart is the name for this category of e-commerce attacks that skims the payment card data of online shoppers. Magecart used malicious code to compromise Volusion, including all sellers using the platform to host their online stores. Volusion confirmed that customer credit card data for online shoppers who buy from its hosted stores was included in the hack.

The prolific cybercrime group known as FIN6, operating out of Russia, is believed to be behind the Magecart attack on Volusion. Since 2015, cybercriminals have used Magecart for other large-scale attacks including those on British Airways, Ticketmaster, and Forbes. Magecart attacks are a form of data skimming allowing hackers to implant malicious code into websites to steal credit card information. Its malicious code is designed to duplicate credit card details from customers and make it available to cybercriminals. As shoppers enter their credentials on the checkout page, the data is skimmed and collected by hackers who do what they want with it, including selling it on the Dark Web. Volusion confirms a fix for the problem was issued within hours of being notified of the security incident.

Since the attack on Volusion isn’t likely to be the last against online retailers, especially going into the holiday season, shoppers are urged to use proactive security steps when making a purchase on any online site.

• Make sure your device firewall is turned on as well as having anti-virus software installed and kept up-to-date.

• Carefully check the URL for the website you’re shopping on for the following: The lock icon should be there, as well as the green colored text before the URL; there should always be “https://” before the actual website address and not "http://"; always double and triple check the URL address.

• Hackers love to inject slight misspellings, transpose letters, and do other URL manipulation. The slightest change to a URL can send shoppers to a hacker’s own website, created to steal payment card data.

• It’s OK to browse on websites but never make a purchase using public Wi-Fi and consider using a Virtual Private Network (VPN) for purchase protection.

Remember, a good dose of vigilance goes a long way to safely shopping online.

Stickley on Security
December 12, 2019