eCommerce is an extremely vulnerable industry when it comes to cybersecurity. Unfortunately, the number of hacks gets bigger every year, jeopardizing hundreds of thousands of online stores and millions of customers. The consequences of data breaches are terrible, revenue and traffic losses, lawsuits, reputational damage, etc.
The next sad thing is that every eCommerce solution doesn’t provide 100% protection against cybercrimes, both cloud, and self-hosted ones. You need to be on top of all security patches updates and trends despite the platform you’re using. To prove that, we’re going to take a look at some relatively recent cases of cybersecurity issues among the leading eCommerce platforms.
Providers of cloud solutions consider their products to be the most secure ones. However, as I said before, no system is 100% safe. One of the most hyped cloud solutions for eCommerce Salesforce faced numerous data breach lawsuits. In 2020, the company faced both CCPA and GDPR lawsuits.
Salesforce/Hanna Andersson Lawsuit
The lawsuit against Hanna Andersson, a seller of child apparel, and its supporting platform, Salesforce, was one of the first to cite the California Consumer Privacy Act. In Autumn 2019, a malware on Salesforce Commerce Cloud led to a breach of personal data to the darknet. Comprised data included customer names, billing and shipping addresses, payment card numbers, CVV codes, and credit card expiration dates.
The data was vulnerable from Sept. 16, 2019, through Nov. 11, 2019. However, the online store and Salesforce confirmed this fact only in December, which raised questions. Why did it take so long to discover the breach?
The lawsuit estimates about 10.000 Californian residents affected by this data breach. CCPA allows for recovery of damages up to 750 $ per consumer, which results in millions of dollars losses for defendants.
European Privacy Group Lawsuit
In August 2020, a European privacy group in the Netherlands announced that they were pursuing a lawsuit against Salesforce and Oracle for violation of the General Data Protection Regulation. The group estimated damages of more than $11,9 billion.
Both companies disagree with the prosecution. Oracle claims that the company has no direct role in the real-time bidding process (RTB), has a minimal data footprint in the EU, and has a comprehensive GDPR compliance program.
Salesforce’s Heroku Hosts Magecart Skimmers
In 2019, hackers took advantage of Heroku’s Freemium model, which allowed them to use the platform as a free web host for their skimming operations after signing up for a free account. With the help of Heroku, skimmers were creating fake iframes displayed by a malicious web application above payment forms. They were identical to the original ones and were collecting credit card information from customers without their knowledge and without red flags.
Salesforce Corrupted Client’s Data
During the Marketing Cloud release, between June 4, 2018, and July 7, Salesforce introduced a change in the code that could have caused REST API calls to retrieve or write data from one customer account to another inadvertently. However, the company claimed that they didn’t know if any data was viewed or modified by other customers.
Despite the fact that Shopify has nice security, no system is safe against internal hacks. In September 2020, two Shopify employees stole data from at least 100 merchants. After the accident, the company terminated both employees from the support team.
Two rogues have stolen:
- Postal Addresses
- Phone Numbers
- Full Payment Card Details
Frauds were collecting data using Shopify Orders API, which lets merchants process all orders on accounts of their customers. The investigation continues, and Shopify will provide more new details regarding this conflict over time.
General Cyber Threats
We should also say some words about Magecart, the most talked-about cyberattack group, as it terrorizes all popular eCommerce solutions like BigCommerce, Shopify, Magento, etc. Magecart is a global consortium of several separate cybercriminal groups that are behind the biggest and devastating cyberattacks of the past few years.
Moreover, Visa specialists discovered that Magecart compromises creative ad script tags to leverage digital ad networks to generate traffic to skimmers on thousands of sites. Magecart makes up 17% of all malicious advertisements.
One JS-sniffer campaign, known as TokenLogin, was detected on sites that work with platforms including Magento, Shopify, and Bigcommerce. The tool, which appears to have emerged in March and April of 2016, aims to avoid detection from manual security checks, and then to automatically reinfect a target if it’s removed.
Supply Chain Attacks
In 2018, Magecart stole personal data of 40,000 customers on Ticketmaster.com this way. A group of hackers exploited a third-party script from Inbenta, a chatbot that was providing support on the website. The compromised data included names, addresses, email addresses, telephone numbers, payment details, and login details.
Hackers are constantly developing their technologies. Even the best eCommerce solutions can’t provide online retailers with 100% protection against cyber attacks. You need to follow the latest cybersecurity trends and update your security patches.
Mobecls team also reminds all Magento 1 merchants to migrate their online stores to Magento 2 as it provides better security. Since Magento end of life, Magento 1 doesn’t receive any new security patches and becomes non PCI compliant.
Mobecls Team provides basic, standard & full Magento migration scenarios. Full Magento migration includes settings & data, extensions & integrations, custom functionality, theme & design transfer. Moreover, we’ll help you to create a migration plan. If you’re interested in other Magento migration scenarios, contact our experts.
We reply within 24 hours
If you have an urgent issue and need to get response faster you may contact us:
+37 525 944 33 88 (Viber, Telegram, WhatsApp)
About the author:
E-commerce Journalist at Mobecls
2+ years experience
Feel free to ask me anything about this post in the comments below