A US entertainment company has become the latest brand to have its e-commerce store attacked in a data harvesting raid using malicious JavaScript and phishing techniques.
Texas-based Rooster Teeth makes podcasts, animated shows and short-form content for distribution, but also has a Shopify-based online store which sells merchandise.
It was this site that was compromised at the start of the month, according to a breach notice from the firm.
“On December 2, 2019, Rooster Teeth discovered that malicious code had been added to the site earlier the same day. The malicious code directed users entering a checkout on the site to a spoofed web page where they were asked to enter payment card details in order to complete their purchases,” it explained.
“This was inserted after the stage at which users entered their shipping data. Users who completed the payment card details page were then directed to the real web page, where they were asked to complete the forms again. We removed the malicious code from the site and took other steps to secure the site against further unauthorized access.”
The incident was fortunately spotted swiftly by the firm’s IT team and therefore affected only a “limited number” of customers.
However, those who did get caught in the incident will have had their name, email address, telephone number, physical address, and/or payment card information including expiration dates and security codes stolen.
Rooster Teeth is offering these customers Experian credit monitoring services for a year.
The incident calls to mind a similar attack discovered in November, when hackers went after the Australian Commonwealth Bank with malicious JavaScript which redirected customers to a phishing payment page.
In the meantime, more traditional Magecart attacks continue to cause major problems for online stores. The most recent brands to be hit include Macy’s and Smith & Wesson.