Situation — Attack, leak or dispute

Our online shop was hacked: our customers' card details were stolen at checkout.

Context

Your bank calls you. Several customers have seen unknown payments on their card. What they have in common: a purchase on your site.

The site is running normally. Nothing looks wrong.

The problem

  • Skimming code on a payment page is invisible to your customers, and often to you.
  • Every day it stays in place, more cards are copied.
  • Bank, customers, CNIL (French data protection authority), insurer: everyone wants answers at the same time.

Case study

Real-life caseAugust–September 2026

Les Cousins, online arts and crafts shop, France

From 25 August to 5 September 2026, malicious code was placed on the payment page of Les Cousins, a French online shop selling ceramics and arts and crafts supplies.

For about twelve days, it copied the card details customers entered at checkout. This was not an old stolen database.

The company detected and neutralised the code, then informed the authorities and its bank. It asked the affected customers to block and replace their cards. The number of customers affected has not been published.

In October 2026, two serious flaws were disclosed in PHP, the language that WordPress and Magento run on. They allow attackers to take control of the server without a password, even when the shop's own code is clean (Sansec (opens in a new tab)). On 21 October, French prefectures and Météo-France took their sites offline as a precaution (Cyberattaque.org (opens in a new tab)).

Read the sourceLes Cousins: a hacker intercepts bank card data — Cyberattaque.org (opens in a new tab)

Why us?

  • We find the skimming code and the route it came in by.
  • Before the site goes back online, we re-run the attack to check the flaw is really closed.
  • We keep the evidence for your bank, your insurer and the CNIL.
  • Attack in progress? Email contact@orbitalmz.com with the subject "Attack in progress": these messages are read first.

Contact us

Talk to an expert

A free 30-minute video call with one of our experts, then your free quote, with no commitment.

Take the diagnostic

A few questions, the first already answered for your situation: your answers help us prepare the video call. Free, no sign-up, about 2 minutes.

Take the diagnostic