The facts

  1. Sansec identified the attack on 24 October. It affected a self-hosted Plausible analytics script on Convertr's infrastructure that merchant checkout pages loaded; this does not establish a breach of Plausible's hosted service. [1]

  2. The malicious script collected card numbers, expiry dates, security codes, cardholder information and Brazilian CPF tax identifiers, according to Sansec. [1][2]

  3. Sansec confirmed the replacement script was clean on 27 October. Cached copies could persist for up to 24 hours after replacement. [1]

  4. The researchers suspected CVE-2026-8467 as an entry point but had not established that cause. Convertr had not answered BleepingComputer before its report was published. [1][2]

Still unconfirmed

  • The number of affected shoppers, total fraud losses and initial intrusion method remain unconfirmed.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 07:46 UTC.

BleepingComputer's technical account relies on Sansec. No separate victim count or confirmed entry vulnerability has been established.

  1. Convertr Plausible supply-chain attack

    Sansec · Primary source · 26 Oct 2026

    Updated 27 October with cleanup confirmation.

  2. Hackers hijack Convertr analytics script to steal payment-card data

    BleepingComputer · Reporting · 27 Oct 2026

Report a factual error