A large-scale e-commerce security incident has affected 953 online stores, most of them using Magento, according to findings published by security company Sansec. The campaign, which Sansec said has been active since July 2025, reportedly uses malicious JavaScript designed to avoid detection by some automated scanners.

For businesses selling online in Europe, the development is relevant because it points to a familiar but costly risk: attackers modifying storefront code in ways that can expose customers, disrupt transactions and create potential compliance and reputational issues.

What happened

Sansec said an unknown threat actor infected 953 online stores as part of a long-running campaign. Most of the affected sites were reportedly running Magento. According to the company, the attackers inserted a small code snippet into store pages and used Magento CMS blocks to deliver malicious JavaScript loader code to site visitors.

Based on the source report, the JavaScript was built to evade some forms of scanning. That matters because many merchants rely on external monitoring tools to detect unauthorised changes on payment or checkout pages. If malicious code is selectively delivered or hidden from scanners, stores may remain compromised for longer.

The source material does not independently confirm how the initial compromises occurred, how payment data may have been targeted, or whether all affected stores were in Europe. However, the attack pattern is consistent with broader e-commerce skimming and storefront-injection risks that have affected online retailers for years.

Why it matters for European businesses

For European companies, especially SMEs running their own online shops or relying on agencies to maintain them, this type of compromise can have direct business consequences.

• Customer trust risk: If shoppers are exposed to malicious code, confidence in the brand can fall quickly, even when the store remains technically online.
• Revenue disruption: Security incidents on storefronts can force emergency maintenance, payment restrictions or temporary shutdowns during investigation and clean-up.
• Compliance exposure: If customer or payment-related data is affected, businesses may need to assess obligations under GDPR, payment security rules and incident reporting processes.
• Detection challenges: Scanner-evasive techniques mean standard security checks may not be enough, particularly for merchants with limited in-house security expertise.
• Third-party dependency risk: Many stores depend on plugins, themes, hosting providers and external developers, which can complicate responsibility and slow incident response.

Magento remains widely used in more complex e-commerce environments, but the broader lesson applies beyond one platform: any system that allows content injection, theme customisation or third-party scripts can become a target if not tightly controlled and monitored.

Who may be affected

• Magento merchants: Businesses operating Adobe Commerce or Magento-based stores should treat the report as directly relevant.
• E-commerce SMEs: Smaller retailers with limited security monitoring may be slower to detect storefront tampering.
• Digital agencies and developers: Service providers managing multiple client stores may need to review shared practices, admin access and code deployment controls.
• Marketing teams: Teams adding tags, scripts and page content through CMS tools should be aware that these same mechanisms can be abused by attackers.
• IT and security teams: Organisations responsible for web application security, change monitoring and incident response may need to reassess storefront protections.

What companies should consider

While the source report is limited, businesses can take several practical steps based on established e-commerce security practice:

• Review Magento CMS blocks and custom scripts: Check for unauthorised code, recent unexplained changes and suspicious JavaScript loaded from unfamiliar sources.
• Audit admin access: Review privileged accounts, enforce multi-factor authentication where available and remove unused or shared administrator credentials.
• Check file and content integrity: Use change monitoring for templates, CMS content, checkout pages and JavaScript assets, not just core application files.
• Update platform and extensions: Ensure Magento core, modules, themes and server components are patched and supported.
• Validate third-party dependencies: Review plugins, tags and integrations that can inject client-side code into storefront pages.
• Monitor the checkout journey: Test pages from an external user perspective and look for unexpected scripts, redirects or unusual browser behaviour.
• Prepare an incident process: Merchants should know who handles forensic review, customer communication, legal assessment and restoration if storefront compromise is suspected.

For European e-commerce businesses, the main lesson is not limited to Magento. Any online store that processes customer data or relies heavily on front-end scripts should treat website integrity as an operational and commercial priority, not only a technical one.