A group of hackers embedded code that steals card details and CPF numbers from customers shopping on dozens of Brazilian fashion stores. The code copies the card number, expiration date, CVV, cardholder name, and CPF of anyone making a payment—and has been active since October 24. As of this morning, the infected file was still online. The hackers did not need to breach each store individually. These brands use Convertr, a Brazilian platform that manages their online stores and checkout processes. The malicious code was inserted into a single statistics tracking file hosted by Convertr, which loads on every checkout page across the platform. The discovery was made by Sansec, a Dutch e-commerce security company. According to Sansec, the group is Brazilian and has been under surveillance since July 2024. Sansec notified Convertr but received no response; as of this morning, Convertr had not made any public statement. It is currently unknown how many people had their data stolen. If you made a purchase with a card on any online store since October 24 and the payment page URL contained “checkout.convertr,” contact your bank immediately to block and replace your card, and monitor your CPF for any suspicious activity.