iOttie, a manufacturer of mobile accessories and car mounts, warns that its website was hacked for nearly two months to steal credit card and personal information from online customers.
Mobile device car mounts, chargers, and other accessories are popularly manufactured by iOttie.
iOttie claims that they discovered on June 13 that its online store was compromised with malicious scripts between April 12, 2023, and June 2, according to a new data breach notification that was released yesterday.
“We believe that criminal e-skimming took place between June 2 and April 12, 2023. “However, the malicious code was removed on June 2, 2023, during a WordPress/plugin update,” the iOttie data breach notification warns.
“However, they might have gotten your credit card information so that you could buy the product of our client online at www. iOttie.com.”
Although iOttie has not disclosed the number of affected customers, it has stated that financial account numbers, credit and debit card numbers, security codes, access codes, passwords, and PINs could have been stolen.
This sort of assault is known as MageCart, which is when danger entertainers hack online stores to infuse pernicious JavaScript into checkout pages. The script steals the inputted data and sends it to the threat actors when a customer enters their credit card information.
On dark web marketplaces, this data is either sold to other threat actors or used for financial fraud, identity theft, or both.
All iOttie customers who bought a product between April 12 and June 2 should keep an eye on their credit card statements and bank accounts for fraudulent activity because this attack could expose detailed information.
Although iOttie has not disclosed the method by which they were compromised, their online store is a WordPress site that utilizes the WooCommerce merchant plugin.
WordPress is one of the most frequently targeted website platforms by threat actors. WordPress plugins frequently contain vulnerabilities that make it possible to completely take over websites or inject malicious code into WordPress templates.
Since iOttie revealed that a plugin update removed the malicious code, the hackers probably exploited a WordPress plugin’s vulnerability to gain access to the website.
Several WordPress plugins, including Advanced Custom Fields, Elementor Pro, and cookie consent banners, have recently been compromised by threat actors.
