Magecart group hits electronic kit seller Kitronik

• The stolen information includes names, email addresses, card numbers, expiry dates and more of the customers.
• The card-skimming Magecart spyware had been attacking the website over a period of two months.

The education electronics outlet Kitronik announced that it suffered a data breach that is suspected to have been carried out by the infamous Magecart group. The company believes that only details that were entered in the checkout page of the website have been compromised in the breach.

The stolen information includes names, email addresses, card numbers, expiry dates, CVV numbers and postal addresses of the customers.

The Kitronik’s co-founder, Geoff Hampson told customers that the card-skimming Magecart spyware had been attacking the website over a period of two months, between August to September 2018.

"Anyone that has followed the news in recent months will be aware of the malicious software ‘Magecart’ that has been recording customer’s key presses on such high profile websites as British Airways and Ticketmaster. The malicious software records key presses at the checkout stage, to capture sensitive details.

“From some point early in August until mid-September the same malicious software has been present on the Kitronik website," Hampson wrote in a notification email, The Register reported.

Kitronik’s website uses the open-source Magento on its e-commerce platform. The company became aware of the breach after it received an alert from its payment gateway provider.

“Although we have a mechanism in place to alert us if the code on the website changes, this attack was very sophisticated and bypassed that code by making changes to the website database,” said Hampson. “The companies that take card payments on our behalf monitor trends and it was the payment gateway provider that notified us of a higher than normal amount of fraud, which triggered our investigation.”

It is still unknown as to how many customers were affected by the breach. However, the senior executives of Kitronik believe that credit facilities that are linked with the schools and businesses are not affected.

The notorious Magecart group has been very active for the last few months. British Airways, Newegg, Ticketmaster and Feedify are some of its known victims.