Newegg, one of the largest online retailers in the US, is the latest victim of the hacking group Magecart. The group managed to infiltrate the Newegg website and inject 15 lines of malicious JavaScript code to the retailer’s payment page. The Magecart hackers utilized a digital credit card skimmer that remained on the payment pages of the retailer for over a month between August 14 to September 18, 2018.
When customers placed their purchase on one of Newegg’s payment pages, the malicious code siphoned off their credit card information to a server controlled by the hackers. The server utilized a similar domain name, neweggstats(dot)com, which was registered on August 13, even going as far as acquired an SSL certificate issued by Comodo for the domain.
The hacking group then inserted the skimming code into the payment processing page of the Newegg website. The code only came into play once a customer added a product to their shopping cart, validated their shipping information, then proceeded to the payment processing page. This is where the code went to work, once the customer hit the submit button after entering their credit card information, the skimmer code immediately sent a copy of the data to the hacker's domain without interrupting the checkout process. Newegg removed the code on Tuesday, after being contacted by incident response firm Volexity. But with over 50 million shoppers visiting Newegg’s website monthly, the hack is expected to affect Millions.
Our Advisory Services Division here at Crossroads Technologies, advices customers of Newegg who entered their credit card information during the attack period to contact their bank. You should immediately contact your bank, block your payment card, and request a replacement. This is not the first attack by Magecart and will likely not be the last. For those concerned about the future, we suggest, always monitor your charges, and turn on “Card Not present” alerts for all your cards so when internet or phone purchases are made you will be alerted.
For businesses utilizing online credit card processing, we urge you to take a proactive stance on protecting your consumers. For those who would like to speak with our Advisory Services Division, please contact us at call +1 (866) 216-4366 or email This email address is being protected from spambots. You need JavaScript enabled to view it..
Articles You Might Find Interesting:
Variabilization of Information Technology
Microsoft COM Hijacking- Video
The Blame Game After a Data Breach
ERP Fine Print - Do You Know What You're Deploying?
Share this article: