Convertr leak: bank cards stolen at online checkout
When they confirmed an order, customers of dozens of Brazilian fashion brands handed their card number and security code to attackers. The trick was not to break into each shop one by one. The attackers changed the statistics script that all of these checkouts loaded together.
This article will also interest you: 600,000 bank cards stolen: three AIs compromised hundreds of online stores
These brands run their store and payment page on the Brazilian platform Convertr. The company says its merchants have generated more than 2 billion reais in sales, about 320 million euros. That figure measures store activity, not money stolen: Convertr has not published how many cards were captured. Dutch security firm Sansec spotted the malicious code on October 24, 2026, and Convertr removed it on October 27, 2026.
The identified victims are in Brazil. The same pattern applies to any merchant that adds an outside script to a payment page. If you paid on or after October 24 on a page whose address contained checkout.convertr, the useful step is to have the card blocked and replaced.
What happened on Convertr payment pages
Convertr adds an audience-measurement program to each store, hosted on a Plausible server that the platform runs itself. Plausible is an open-source alternative to Google Analytics. Attackers inserted malicious code into that program. On each order it collected the card details typed into the form, plus the customer's CPF, the tax number Brazilian banks use to identify clients.
The script is served from a single file on the server. Changing that file is enough to reach every site that loads it, Sansec explains. Every Convertr payment page therefore loaded the same trap. Two days after planting it, the attackers adjusted it so it matched the platform's payment form.
Convertr installed the self-hosted edition of Plausible in 2025 and did not update it afterward. Versions 3.0.0 through 3.2.0 contain the critical flaw CVE-2026-8467, which the publisher fixed in May 2026. Sansec suspects entry through that flaw but cannot confirm it, because it did not have the server logs. How that flaw is exploited is not established in this case. For anyone hosting the software, the useful fix is version 3.2.1.
Sansec has tracked this Brazilian group since July 2024. Until now it infected online stores one by one, almost all in Brazil, and some stayed infected for nearly two years. The team says Convertr is the first supply-chain attack it has seen from this group.
Who is affected by this card theft
The people affected are customers who paid by card on a Convertr checkout while the script was in place, from October 24 to October 27, 2026. The infected script can stay in the browser cache for up to 24 hours. A customer can still load it a day after cleanup if they reopen a page they already visited.
The exposed data is what was typed at payment: the card number, the security code, and the CPF. Convertr says it is notifying affected merchants and the authorities. It has not given the number of cards captured during those three days. There is no public total of losses at this stage.
This group also attacks WooCommerce stores directly. According to a March 2026 study cited in accounts of the case, 47.4 percent of French online stores run that software. That percentage describes the store landscape, not a share of French customers already hit by the Convertr incident.
How Convertr and Sansec responded
Convertr removed the malicious code on October 27, 2026. The company says it is informing affected merchants and the authorities. Sansec, for its part, asks merchants who host Plausible themselves to install version 3.2.1, the release that fixes the flaw in the versions left without updates.
The gap between detection on October 24 and removal on October 27 leaves three days during which payment pages loaded the trapped script. Browser cache extends that window by another day for customers who return to a page already open.
Why it matters outside Brazil
A card number and security code are enough, on some sites, to attempt a payment. The CPF adds a Brazilian tax identifier that can tie the card to a person. Collected at the moment of payment, these details go far beyond audience measurement.
In Europe, reusing a stolen French card number generally has to pass 3-D Secure and approval in the cardholder's banking app. Since January, major French banks have rejected payments without 3-D Secure once they exceed one cent in 24 hours at the same merchant, when that merchant collects through a European provider. That is what the 2025 report of the Observatory for the Security of Payment Means says.
According to the same Observatory, fraudsters mostly use cards copied on tampered terminals to pay on sites outside Europe that do not require strong authentication. On those international payments outside the European Economic Area, the fraud rate is 0.376 percent, compared with 0.026 percent on domestic transactions. A card stolen in Brazil is not automatically replayed at a French merchant, but it remains usable where strong authentication is not required.
How to protect your card
1. Block the card if the page contained checkout.convertr
Sansec advises anyone who paid for an order at a Brazilian store on or after October 24, 2026, to have the card blocked and replaced when the payment-page address contained checkout.convertr. Contact your bank with the date and the store name, and ask for a new card number, not only a short hold, if the bank can issue one.
2. Do not confirm payment on a page already open
The infected script can remain in cache for 24 hours. After the October 27 removal, a tab or a page already loaded can still hold the old version. Close that page, reopen the store from an address you type yourself, and do not enter the card again on a form that stayed on screen.
3. Use a single-use virtual card for online purchases
For later payments, a single-use virtual card keeps the real number out of reach of a compromised site. The advice applies to any checkout that loads outside scripts, not only to the Brazilian stores in this case.
4. Watch charges and ask for the refund that applies
Review card activity since October 24. If a payment without strong authentication still goes through, the bank must refund you without delay, including in a case of serious negligence on your part. That reminder comes from the Observatory for the Security of Payment Means, not from an intermediary you would need to pay.
For merchants, the lesson is plain: a statistics tool does not belong on the page where the customer types a card, especially if it is no longer updated. Those who host Plausible themselves should move to version 3.2.1.
FAQ: Convertr checkout and bank cards
What is Convertr in this case?
Convertr is the Brazilian platform that provides the online store and the payment page for dozens of fashion brands. Its shared statistics script, loaded by those checkouts, is what was modified.
What data was taken?
The card details typed into the form, including the number and security code, plus the customer's CPF. The number of cards involved has not been published.
Are the 320 million euros a stolen sum?
No. That amount is about 2 billion reais in sales announced for Convertr's merchants. It is not a fraud total.
What if I paid on a checkout.convertr page?
If the payment was on or after October 24, 2026, ask your bank to block and replace the card, then watch the charges. The script could stay in cache for up to 24 hours after the October 27 cleanup.
Key points
- A shared statistics script captured cards at payment on Convertr checkouts from October 24 to October 27, 2026.
- The data taken is the card information from the form and the CPF. The number of cards is not public.
- The 2 billion reais, about 320 million euros, describe merchant sales, not a haul.
- If the payment address contained checkout.convertr, have the card blocked and replaced. The script could stay in cache for 24 hours.
- In Europe, 3-D Secure slows reuse of a French card. Merchants who host Plausible should install version 3.2.1.
This case is a reminder that a payment page should load only what is needed to take the payment. A shared visit counter, left without updates, was enough to expose cards across dozens of stores at once. If you paid on one of those checkouts, replacing the card is still the safest step, while banks watch payments made without strong authentication.
