Why Protecting Your Magento Ecommerce Website Is So Damn Important

What actually happens behind the scene?

Like most Magento sites, the site scanned by the researchers had a checkout form that asks for customers' credit card details.

However, Magento encrypts this information and saves it, and sends it to the payment gateway in order to complete users' transaction.

But, at the moment between the checkout form submission and encryption of the user's payment details when Magento handles customer's sensitive information in a plain text, the code injected by hackers send this unencrypted data to third-party address.

Not only Magento sites are targeted:

Researchers also found a very similar code being injected by hackers into the Joomla Donation extension in Joomla websites in order to send customers' credit card information to the hackers using "java-e-shop .com/add."

Moreover, all e-commerce solutions, including CMS, plugin, and extension, are equally susceptible to this kind of cyber attack in the event they request customers' credit card details directly on a site, instead of redirecting them to a payment gateway.