Overall, there have been an average of 425 Magecart incidents per month in 2020. In many cases, attackers deploy social engineering tactics, such as sending shoppers a bogus promotion for a site. When shoppers respond to the fake offer, they enter their personal data on a page that is actually a skimming scam.

The Gocgle’s malicious campaign, which hit hundreds of shopping websites, demonstrates how hackers used Google’s legitimate tool for impersonation in order to compromise the code and steal valuable information.

In November 2019, Macy’s confirmed there was a credit card-skimming Magecart malware on its checkout and wallet pages just as Black Friday and the holiday shopping season approached. Macy’s indicated that the malware allowed a third party to capture customers’ data on the pages if they input their credit card information and clicked “Place order.”

2. Third-party vendors
The fact that there are multiple third-party vendors that support online sales further exposes retailers to possible threats. Cybercriminals often target third parties because they’re the weak links in the supply chain. On average, e-commerce sites use 40 to 60 third-party tools and intend to add three to five new third-party technologies each year, amplifying the risks.

Outdated or fake plugins also add to the risk package. When used on companies’ websites, these compromised plugins can lead to the spread of malware.

3. The increased danger of open-source software vulnerabilities
Open-source software uses code that anyone can view, modify, or enhance. And while it has been hugely valuable to e-commerce businesses, it also carries a number of Cybersecurity threats challenges.

“Open-source software is popular because it is often free to use or can be modified to suit the individual needs of a business. But this popularity means that any vulnerabilities found in the code can be a massive problem across a huge number of websites. Add the changes COVID-19 has brought, and the problem has intensified even more. Companies should really start making technical improvements to their websites fast if they want to avoid a potentially catastrophic breach. If they continue using unpatched, open-source software with vulnerabilities, they’ll leave themselves open to attacks,” comments Juta Gurinaviciute, Chief Technology Officer at NordVPN Teams.

Other security threats to e-commerce sites include phishing, ransomware, SQL injection, DDoS attacks, and cross-site scripting (XSS).

“The minute retailers see unusual traffic patterns, they should assume an Cybersecurity threat attack designed to slow the site down, take it offline, or steal data is underway,” the NordVPN Teams expert adds.

How to protect your e-commerce site
E-commerce security is never a done deal. Threats and hacking methodologies evolve at an alarming rate, so maintaining awareness and a security-focused mindset is the key to staying secure. Layering multiple solutions for business security is one of the best ways to keep an online business safe against cyber attacks.

1. Implement Zero Trust: It’s essential to enforce zero-trust solutions that restrict third parties to information the website has authorized them to access while blocking access to consumers’ private and payment information, also known as “least privilege.”
2. View your site as a customer. Too many businesses only see their website as it appears on the server side, instead of viewing it from the customer’s browser perspective. The browser page is what customers “see” when they shop, and these pages are subject to compromise. Therefore, you need to assess what you’re doing to protect your pages once they leave the web server.
3. Bonus: implement firewalls (including web application firewalls), making sure the connection is secure and passwords are strong, implementing multi-factor authentication, using intrusion detection systems, and constantly monitoring and updating web platforms.