<div dir="ltr"><a href="https://www.computerweekly.com/news/252490346/Magecart-strikes-website-of-school-payments-service-Wisepay">https://www.computerweekly.com/news/252490346/Magecart-strikes-website-of-school-payments-service-Wisepay</a><div><br></div><div><a href="https://www.wisepay-software.com/">Wisepay</a>, a supplier of
financial services for schools that enables parents to pay for school
meals, clubs and trips, among other things, has recovered its service
after discovering <a href="https://www.computerweekly.com/opinion/JavaScript-skimmers-an-evolving-and-dangerous-threat">a Magecart skimmer</a> on its website was leaching credit card numbers earlier in October </div><div><p>The firm said that data on an undisclosed number of transactions to
approximately 300 schools may have been stolen when users who thought
they were making legitimate payments were redirected, without their
knowledge, to a malicious external page masquerading as Wisepay’s
website.</p>
<p>The firm’s managing director <a href="https://www.bbc.co.uk/news/technology-54465359">Richard Grazier told the BBC</a>
the website was compromised via a “backdoor” in its database, and that
only a small subset of the platform’s users would have noticed. This may
be in part because the initial compromise occurred late on Friday 2
October and was discovered the following Monday, and far fewer payments
would have been processed over the weekend.</p>
<p>Wisepay has notified both the Information Commissioner’s Office (ICO)
and the police about the incident, which it said had not compromised
any of the data it holds on its systems, and warned parents that any who
think they may have been affected should immediately contact their
banks or credit card providers, and change their online banking
credentials.</p>
<p><a href="https://searchsecurity.techtarget.com/akamai/Video-Decoding-Magecart-Web-Skimming-Attacks">Magecart works</a> by injecting malicious JavaScript code into websites and third-party payment systems to steal credit card information <a href="https://www.computerweekly.com/news/252484652/Accessories-store-Claires-hit-by-Magecart-credit-card-fraudsters">while people enter it at the checkout,</a> thinking they are making a legitimate payment. Recent high-profile victims <a href="https://www.computerweekly.com/news/252484652/Accessories-store-Claires-hit-by-Magecart-credit-card-fraudsters">include accessories store Claire’s</a>.</p>
<p>It is a relatively simple form of cyber attack, with high reward
potential for malicious actors, and as a result the technique is widely
used by a variety of threat actors, <a href="https://www.computerweekly.com/news/252485702/North-Korea-behind-spate-of-Magecart-attacks">including the infamous Lazarus group</a>, which is linked to the North Korean government. Their prevalence has spiked since March 2020 given <a href="https://www.computerweekly.com/news/252481069/Coronavirus-Magecart-attacks-on-online-retailers-jump-20">far more people are shopping online</a> during the Covid-19 pandemic.</p>
<p>Often, Magecart attacks begin in a targeted spearphishing attack on a
member of staff at the victim organisation, but cyber criminals have
also been known to exploit <a href="https://www.computerweekly.com/news/252474188/Macys-Magecart-breach-presages-Christmas-fraud-spike">unsecured Amazon Web Services (AWS) S3 buckets</a> and unpatched versions of Adobe’s Magento software, <a href="https://www.computerweekly.com/news/252489115/Retailers-urged-to-get-to-grips-with-Magento-as-attacks-spike">which is about to enter end-of-life</a>.</p>
<p><a href="https://proprivacy.com/">ProPrivacy</a>’s Attila Tomaschek
said: “The Wisepay cyber attack highlights very clearly the dangers of
online card skimming attacks. Wisepay would be an attractive target for
cyber criminals looking to launch such an attack due to the large number
of UK schools served by the online payment portal.</p>
<p>“The main problem, however, is that these types of attacks can be
incredibly difficult to detect and, therefore, avoid. Those entering
their credit card information into a compromised payment page would
really have no idea that they were handing their card details over to
cyber criminals because these malicious payment pages are designed to
appear perfectly legitimate.</p>
<p>“While the responsibility to maintain secure payment pages obviously
resides with the merchant, consumers can protect themselves by keeping a
close, continuous eye on their credit reports and bank account
statements and refraining from clicking on dodgy links or entering
sensitive information onto any online form that seems off or compromised
in any way,” said Tomaschek.</p>
<p>“Educational institutions need to keep their eyes on the networks for
signs of intruders or user accounts escalating privileges, as well as
making sure the fundamentals are still happening despite all the
distractions of the start of term, like making sure old and unused user
profiles are shut down and can’t be used by attackers,” added Jérôme
Robert, director at active directory specialist <a href="https://www.alsid.com/">Alsid</a>.</p>
<p>“Given the turmoil in the education sector right now thanks to Covid,
this is yet another headache for schools. There has been a spate of <a href="https://www.computerweekly.com/news/252489125/NCSC-steps-up-ransomware-support-for-schools-and-universities">highly publicised ransomware attacks against universities</a>
recently, likely timed to coincide with the start of term – which
attackers hope will increase their chances of success,” he said.</p><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><span></span></div><div dir="ltr"><div><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><b><span style="font-size:10pt"></span></b><span style="font-size:10pt"></span><span style="font-family:arial,helvetica,sans-serif"></span><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>