TL;DR: notable Magecart incidents
- The simple pattern: Big-name breaches make headlines, but the pattern behind them is simple: one compromised third-party script on a checkout page, and weeks of silent skimming while the transaction still completes.
- Weeks of skimming: British Airways skimmed roughly 380,000 transactions and the Ticketmaster campaign ran for months, and cside monitors every script on every real user session so a behavioral change surfaces the first time the code acts.
- You are the target: If you assume your brand is too big to be targeted, you are exactly the target profile these campaigns pick, so put runtime monitoring on the checkout page before the next third-party vendor script turns malicious.
Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.
Magecart attacks are e-commerce payment fraud attacks where hackers secretly inject malicious JavaScript, usually by compromising a trusted third-party script, into checkout pages to silently steal card numbers, CVV codes, and addresses as customers type them. The name combines "Magento" and "cart" from the platform originally targeted, but now covers all browser-side skimming regardless of CMS.
Where the term "Magecart" comes from
Magecart attacks are a type of cyberattack where hackers inject malicious JavaScript code, often referred to as "skimming" scripts, into websites. This can be any type of website, but when talking Magecart, it's almost exclusively e-commerce sites to try and capture credit card details.
The term "Magecart" originates from the combination of "Magento," a popular open-source e-commerce platform, and "cart," referring to the shopping cart feature on these websites. The initial wave of attacks targeted Magento-based websites, which is how the term was coined.
These types of attacks fall under the umbrella term of "client-side attacks" and "web supply chain attacks" too.
Evolution into a generic term
Over time, "Magecart" itself evolved from referring to a specific group of hackers into an umbrella term used to describe a broader style of attacks:
- As the original Magecart group's methods proved effective, other cybercriminal groups adopted similar techniques.
- While early Magecart attacks primarily focused on Magento sites, the scope has widened significantly. Attackers now target a variety of content management systems (CMS) and e-commerce platforms, such as WooCommerce, PrestaShop, Shopify, and custom-built websites.
- Modern Magecart attacks often exploit vulnerabilities in third-party services integrated into websites, such as chat widgets, analytics scripts, or payment processors. This shift, from targeting e-commerce platforms directly to attacking the broader web ecosystem, is why the term now covers more ground.
- High-profile incidents involving major brands like British Airways, Ticketmaster, and Newegg brought significant media attention to Magecart attacks. Often articles mention the name as a callback, while not necessarily being a "Magecart" attack in the original sense of the word.
In general, when someone mentions Magecart, think digital skimming.
The biggest Magecart attacks thus far
These are the Magecart attacks we currently know about. There are likely many more happening right now. If we discover additional attacks, we will update this post.
We've ranked these broadly based on people impacted, financial implications, media coverage and reputational damage.
1. British Airways
This is often considered the largest and most high-profile Magecart attack. It's also the one we most often quote. Partly, because we bought the domain used in that attack, baways.com (safe now), and told the full story of the attack there.
While we wish we could say we had to go through some elaborate schemes to get that, we just bought it on a public registry. Read that story here.
In this attack, the domain was bought by the attackers and inserted into a tampered third-party script to stay under the radar for longer. After all, BAWAYS sounds like a legit British Airways domain.
But in other cases, expired or sold domains that feature in third-party scripts have a direct path to exploit many websites in one fell swoop. While not a Magecart attack, the recent Polyfill attack showed us why it's important to secure your site against this.
The British Airways (BA) hack from September 2018, was quite a sophisticated Magecart attack that compromised the personal and financial information of around 380,000 people. The hackers exploited vulnerabilities in British Airways' online payment system by injecting malicious JavaScript code into the airline's website and mobile app. This code was specifically designed to capture payment information in real-time as customers entered their details on the payment page
The stolen data included names, email addresses, and complete credit card details, including CVV codes, making it highly valuable for fraudulent activities. And, the attack went undetected for over two weeks, allowing the attackers ample time to collect sensitive customer information.
This breach had significant repercussions for British Airways, both financially and reputationally. The UK's Information Commissioner's Office (ICO) fined British Airways £20 million ($26 million) and the breach also led to widespread criticism of British Airways' cybersecurity practices.
2. Ticketmaster
This attack affected approximately 40,000 customers but was significant due to the involvement of a third-party service provider (Inbenta).
Again, the attackers injected malicious JavaScript code into this third-party widget, allowing them to siphon off customers' credit card details, names, addresses, and other sensitive information as transactions were processed on Ticketmaster's site. The malicious code remained undetected for several months, during which the attackers harvested valuable customer data.
As a result, Ticketmaster faced criticism for failing to adequately vet its third-party partners and for the delay in detecting and responding to the breach.
In May of 2024 we experienced a bit of déjà vu when news broke of another Ticketmaster incident that bore a striking resemblance to the infamous 2018 data breach.
This new incident was somewhat similar to the first, as Ticketmaster confirmed unauthorized activity within a third-party cloud database environment, claiming to have exposed the personal information of over 500 million customers. Here's our full write up of this latest Ticketmaster breach.
3. Newegg
The Newegg hack is one of those classic Magecart attacks that people still talk about. This one was pretty sneaky and showed just how crafty attackers could be. Also in 2018, hackers managed to slip some malicious JavaScript code right into the checkout page of Newegg's website. Their aim? You guessed it, to skim credit card information from customers as they made purchases. The attack also went unnoticed for over a month, which gave the attackers plenty of time to collect a good amount of sensitive data.
What made this attack particularly interesting was the way the hackers operated. They didn't go after Newegg's main site directly; instead, they mimicked Newegg's own payment processing script to make their malicious code blend in almost perfectly. It was a clever move that allowed them to fly under the radar for so long. The stolen data included names, addresses, credit card numbers, and CVV codes.
While Newegg's response to the attack wasn't as swift as some might have hoped, the incident certainly put the spotlight on the need for more vigilant security practices, especially around payment pages. It's one of the reasons the updated PCI DSS 4.0 requirements include securing scripts on payment pages, read up on that if customers make payments on your site.
4. Multiple Magento sites
Instead of going after one big fish, the attackers went for quantity between 2020 and 2021, exploiting vulnerabilities in over 2,000 Magento e-commerce sites. The strategy was simple but effective: use known flaws in outdated Magento installations to inject skimming scripts into checkout pages and grab credit card info as unsuspecting customers made their purchases.
What's fascinating here is the sheer scope of this attack. By leveraging a widespread vulnerability, attackers were able to impact a massive number of businesses at once, not just a handful of sites.
This kind of attack is particularly concerning for small and medium-sized businesses, which often don't have the same level of security as the big players. And for those still running older versions of Magento, this was a wake-up call.
One of the more recent and biggest Magento Magecart attacks happened to Segway in 2022. The attackers targeted vulnerabilities in the CMS itself or one of the plugins installed on the Segway site. After breaching that, they again added malicious JavaScript. Here, it appeared to display as the site's copyright, but was actually used to load an external favicon.
Inside that favicon file, a malicious domain was placed which loaded external code to skim payment information from unsuspecting customers. Read our full article on that attack here.
5. Volusion
The Volusion hack in 2019-2020 is another Magecart attack that perfectly illustrates the dangers of supply chain vulnerabilities. This time, the attackers went after Volusion, an e-commerce platform provider that powers thousands of online stores.
By compromising Volusion's infrastructure itself, the hackers were able to inject their malicious JavaScript into a JavaScript file served to all websites using Volusion's services. They didn't have to target individual stores one by one, they just needed to slip in through the platform provider and they had access to the payment pages of all those stores in one fell swoop.
The impact was huge, affecting countless small and medium-sized businesses that relied on Volusion to run their e-commerce operations. Customers who shopped on these stores had their credit card details skimmed, which again included names, card numbers, expiration dates, and CVVs.
When your business is dependent on a service provider, their vulnerabilities become your vulnerabilities.
What we learned about Magecart thus far
Let's look at a few common themes in these biggest three Magecart attacks:
- They always target third-party tools active on sites (most often third-party scripts).
- The attacks always remain undetected for a while
- They're always after sites that regular people buying online
So if you run a site with those traits, alarm bells should be going off right now. You can secure your third-party scripts and stop these attacks from happening.
More Magecart attacks
Let's look at a few more notable Magecart attacks:
Warner Music Group
The Warner Music Group hack in 2020 was another notable Magecart-style attack that spanned several months, impacting multiple e-commerce sites associated with this major music label. Hackers injected malicious scripts into the checkout pages of Warner Music's online stores, allowing them to skim payment information from customers buying merchandise and digital products.
Claire's and Icing websites
Claire's, the popular accessories and jewelry retailer, had a rough year in 2020 when it fell victim to not one, but two Magecart attacks. After initially being breached, the company thought it had the situation under control, but the attackers managed to reinfect their websites shortly after the first attack.
American Cancer Society
The American Cancer Society breach in 2019 hit particularly hard, and shows that not even nonprofits are safe from Magecart attacks. Any organization or website with information can, and will, be targeted.
The attackers injected malicious JavaScript code into the donation page of the organization's website, aiming to steal credit card information from donors.
Macy's
Attacker managed to compromise the American department store's online payment system, injecting malicious code to steal payment information directly from customers during the checkout process. While the number of affected customers was smaller compared to some of the other Magecart attacks, the timing was particularly impactful as it occurred during a significant sales period, right when shoppers were flocking to the site for deals.
Regal Cinemas
The Magecart attack on Regal Cinemas in 2022 brought the focus back to the entertainment sector, which, up until then, wasn't commonly associated with such breaches. Attackers targeted Regal's online ticketing platform, embedding malicious scripts to capture payment information from customers purchasing tickets. Quite similar to the Ticketmaster attack.
NutriBullet
NutriBullet, famous for its blenders and kitchen gadgets, found itself on the list of Magecart victims in early 2021. Hackers injected malicious JavaScript into the checkout page of NutriBullet's website, skimming credit card details from customers over several weeks.
Chinavasion
Chinavasion, a well-known Chinese e-commerce platform specializing in electronics, was hit by a Magecart attack in 2023. This incident also targeted the checkout pages to capture payment details from international customers. While the breach wasn't as large as some of the others on this list, it was significant due to Chinavasion's broad customer base spanning multiple countries.
Dick's Sporting Goods
In 2023, Dick's Sporting Goods found itself among the list of Magecart victims when attackers managed to inject malicious scripts into their payment page. The breach impacted a large number of customers, but the scale and financial fallout were relatively less severe compared to some of the more extensive attacks on this list.
Marriott Hotels
Marriott Hotels added another chapter to its troubled history with data breaches in 2023 when its online reservation system was targeted by Magecart attackers. The hackers injected skimming scripts to steal credit card information from customers booking rooms online.
There's a bit of a rise in concern of these types of attacks targeting hotel and leisure industry websites. Time will tell if more occurrences of attacks happen in this space.
Here we talked about client-side attacks specifically in the hotel industry.
2024: CosmicSting and the platform-exploit wave
June 2024 brought CVE-2024-34102, a critical unauthenticated XXE (XML external entity) flaw in Adobe Commerce and Magento Open Source 2.4.7 and earlier, publicly named CosmicSting by Sansec. It is an arbitrary server-file read rather than remote code execution on its own, and full code execution required chaining it with CVE-2024-2961 in glibc's iconv library. The file read alone was already enough. Unlike the classic third-party script supply chain approach, this vulnerability let attackers pull the application secret key straight out of the server configuration, generate valid admin API tokens, and inject skimmers into payment page templates without touching any vendor CDN. Sansec tracked multiple Magecart-linked groups exploiting the flaw simultaneously as stores raced to patch.
cside documented one named victim while the campaign was still live: Carlsberg, a target in the Magento CosmicSting malware attack, where a single injected line of JavaScript rendered a fake payment box ahead of the real checkout and sent card details straight to the attacker.
The CosmicSting wave marked a shift: the checkout page template became the attack surface rather than a third-party script loaded onto it. The result for the buyer is identical: card number, expiry, and CVV captured in the browser at the moment of entry. Standard third-party script allowlisting would not have stopped this vector. Only monitoring what scripts actually execute in real user sessions catches both paths.
Digital wallets and cryptocurrency exchanges
From 2022 to 2024, Magecart attackers shifted their focus to digital wallets and cryptocurrency exchanges. By injecting malicious scripts into web wallets and exchange platforms, they were able to siphon off credit card details as well as digital assets like cryptocurrencies.
During our beta phase, multiple crypto currency companies and exchanges contact us to work together on an early version of an expanded product scope to protect their sites. It's a real concern in this industry.
Here's the story of the Copay event-stream attack which also happened in the crypto space. Malicious code would execute routines that searched for and extracted private keys and wallet details from accounts holding substantial amounts of Bitcoin and Bitcoin Cash. These details were then transmitted to a remote server controlled by the attackers.
A few final name drops:
- Soccer[.]com
- Shopify
- Olympus
- Tupperware
- Fujifilm
- Boom! Mobile
- Procter & Gamble
- Smith & Wesson
- Puma
- Crucial (Micron)
- Elekta
How to protect your site against Magecart attacks
Every attack in this list follows the same structure: a third-party script loads on a checkout page, changes behavior some time after deployment, and silently exfiltrates card data until someone notices. Three controls close that gap.
1. Real-time browser-side script monitoring
Network-layer defences and server-side scanners see a script once, at the moment you pull it. Magecart payloads are designed to evade exactly this: they show clean code to crawlers and activate only for specific user agents, geographies, or time windows. The only way to catch a skimmer is to observe what scripts actually do in real visitor sessions.
cside runs as a single first-party JavaScript snippet on your checkout pages: no DNS changes, no re-routing of your traffic. It monitors every third-party script that executes in real browsers and surfaces behavioral changes the first time they appear, including conditional payloads that only trigger under specific conditions.
2. PCI DSS 6.4.3 and 11.6.1
Updated PCI DSS 4.0.1 requirements (effective April 2025) mandate a mechanism to detect and alert on unauthorized changes to payment-page scripts (§6.4.3) and tampering with HTTP headers and page content (§11.6.1). These requirements exist specifically because of attacks like the ones above. Continuous script integrity monitoring is now a compliance obligation for every merchant that takes card payments online. See how cside maps to PCI DSS §6.4.3 and §11.6.1.
3. Content Security Policy and script allowlisting
A Content-Security-Policy: script-src allowlist prevents browsers from loading scripts from domains not explicitly approved. Pair it with a living inventory of every script vendor on your checkout flow. CSP alone is not sufficient (inline injection, trusted-domain compromise, and nonce bypasses remain risks), but it meaningfully raises attacker cost and is a PCI DSS baseline control.
Get started and secure your checkout pages for free, or visit the compare page to see how cside stacks up against other client-side security tools.
