Short answer
Security firm Sansec reported on 27 October 2026 that attackers altered an analytics script on Convertr's servers so it copied payment details typed at checkout. According to Sansec, Convertr removed the code and said it is notifying merchants and payment providers. No count of affected shoppers has been published, and BleepingComputer had no direct statement from Convertr.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Convertr |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Under investigation |
| Sector | E-commerce checkout platform |
| Country | Brazil |
| Detected | 2026-10-24 |
| Disclosed | 2026-10-27 |
| People or records affected | Shoppers who paid by card at Convertr-powered Brazilian stores from 24 October 2026; no count published |
What data was exposed
- Card number
- Card expiry date
- CVV security code
- Cardholder name
- CPF (taxpayer number)
What happened
Sansec, a Dutch e-commerce security firm, said it spotted the campaign on 24 October 2026 and published its findings on 27 October. According to BleepingComputer, Convertr runs checkout for dozens of Brazilian fashion brands and handles about R$2 billion in sales.
The attackers did not break into each shop. They changed one analytics file on a Convertr server, a copy of the open-source tool Plausible. That file loads on the checkout page of every merchant on the platform. Hidden code inside it read what shoppers typed and sent it to the attackers’ servers.
Sansec attributes the work to a Brazilian Magecart-style gang active since at least July 2024. That attribution comes from the researchers, not from Convertr.
Timeline
- 24 October: Sansec identifies the skimmer.
- 26 October: The attackers push a refined version that matches Convertr’s own payment field names, per BleepingComputer. Xataka Brasil reports that Sansec says Convertr did not answer its alerts before this date.
- 27 October: Convertr removes the code and upgrades Plausible. Sansec confirms the file is clean that morning.
How it probably got in
Sansec suspects a flaw tracked as CVE-2026-8467, which lets an attacker run commands on older Plausible installations without logging in. The maintainers fixed it in May 2026. Sansec says it could not confirm this entry point because it had no access to Convertr’s logs.
What is still unknown
Convertr has not named the affected stores or said how many cards were copied. BleepingComputer had no company statement at publication. We have not seen a notice from Brazil’s data protection authority, the ANPD, about this case.
A card skimmer is different from a database leak: your statement will not show that the data was copied, only any later fraud.
For the general steps after any exposure of payment data, read what to do after a data breach. If someone phones or messages you about a “blocked purchase”, see our guides to phishing messages and urgent payment scams. Other shopping risks are covered in online shopping scams. More incidents are listed on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fraudulent card purchases made online with the copied number, expiry date and CVV, which will not show on your statement until the criminals spend.
- Fake bank calls or WhatsApp messages that quote your CPF and the last digits of your card to sound genuine and ask you to 'confirm' a blocked purchase or move money to a 'safe account'.
- Fake order or refund messages from fashion brands asking you to click a link to 'fix' a payment problem.
What to do if you are affected
- 01If you paid by card at a Brazilian online store since 24 October 2026, call your bank (the number on the back of the card) or use its app to block the card and ask for a replacement.
- 02Dispute any purchase you do not recognise with the bank, and file a boletim de ocorrência at a police station or online delegacia if money was taken.
- 03Check the Banco Central Registrato service for accounts, loans or Pix keys opened in your CPF that you did not request.
- 04Clear your browser cache before your next online order, because Sansec says cached copies of the script can stay active for up to 24 hours.
- 05Use a virtual or single-use card for online shopping if your bank offers one, and turn on purchase alerts.
Frequently asked questions
How do I know if I was affected by the Convertr skimmer?
Convertr has not published a list of stores. Sansec says anyone who paid by card on a Brazilian store whose checkout address contains 'checkout.convertr' since 24 October 2026 should treat the card as exposed. The address may not appear in the browser bar, so a clean-looking URL does not rule it out.
Will the theft show on my card statement?
No. Skimming copies the data without changing your purchase. You will only see the damage if criminals use the card, so the safest step is to ask the bank to block and replace it.
Was this a hack of the fashion stores themselves?
According to Sansec, the attackers changed a Plausible analytics file on a server run by Convertr. That file loads on every merchant's checkout page, so one change reached many stores at once.
Has Convertr fixed the problem?
Sansec said Convertr removed the skimmer and upgraded Plausible to a patched version on 27 October 2026, and that Convertr said it is notifying merchants and payment providers. We did not find a public statement from Convertr itself.
Should I change my CPF?
You cannot easily change a CPF, so focus on watching for misuse. Check Registrato, be sceptical of calls that quote your CPF, and follow the steps in our data breach guide.
Sources
- Hackers hijack Convertr analytics script to steal payment card data, BleepingComputer, 2026-10-27
- Se você comprou com cartão de crédito numa loja online desde 24 de outubro, é preciso agir agora (If you bought with a credit card in an online store since 24 October, you need to act now), Xataka Brasil, 2026-10-27
- Ataque hacker atinge plataforma de e-commerce e expõe dados de cartões e CPF no Brasil (Hacker attack hits e-commerce platform and exposes card and CPF data in Brazil), WSCOM, 2026-10-27
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.