U.K. retailer Sweaty Betty is the latest victim of a so-called Magecart attack, as hackers inserted code on its website that intercepted and stole customer payment details.

The hack was first disclosed in an email Tuesday to customers in which the company claimed it had been made aware of “unusual activity” on its website. The email went on to state that the third-party had gained unauthorized access to part of its website and had inserted malicious code “designed to capture information entered during the checkout process.”

The stolen data is said to have included name, password, billing address, delivery address, email address, telephone number, payment card number, CVV number and expiration date. If that list of stolen data sounds familiar, it should because it’s the typical list of data stolen in a Magecart attack, which refers to a group of hackers trying to steal financial information.

Magecart emerged last year with an attack on British Airways Plc., with other sites and companies hacked since. Some of those included Newegg Inc., the Infowars Store, Cathay Pacific Airways Ltd., Ticketmaster Entertainment Inc. and Oxo International Ltd. Macy’s Inc. was a recent victim, with data stolen from its website Nov. 19, although since that time Smith & Wesson has also been targeted.

The number of customers affected is unknown but includes anyone who made purchases from the company via its website between Nov. 19 and Nov. 27 and who had entered new card details when checking out.

Sweaty Betty has launched an investigation and has also informed the U.K. Information Commissioner’s Office in compliance with the European Union General Data Protection Regulation.

“With the holiday retail season in full swing, digital commerce companies can increasingly expect to be a target for account takeover and other e-skimming threats,” Robert Prigge, chief executive officer of identity verification firm Jumio Corp., told SiliconANGLE. “Increasingly, criminals have everything they need to commit fraud thanks to the personal information stolen through this hack and other readily available data on the dark web. This highlights the pressing need for retailers – and any company with a digital presence – to adopt biometric authentication solutions to protect their legitimate users and online ecosystem by verifying that the person placing an online order is, in fact, the account owner.”

Anurag Kahol, chief technology officer at cloud access security broker Bitglass Inc., noted that cybercriminals are well aware of how many millions of consumers shop during this time.

“Unfortunately, when armed with payment card information or personally identifiable information, malicious parties can make fraudulent purchases, sell said data on the dark web for a quick profit and much more.” Kahol said. “While this breach is said to have occurred ahead of Black Friday and Cyber Monday, the holiday shopping season is not over. Companies must deploy security solutions that can prevent data leakage.”

James Carder, chief security officer and vice president of Big Data security firm LogRhythm Labs, pointed out that the malicious code went unsuspected for more than a week.

“This indicates that either an insider or an attacker had access to Sweaty Betty’s environment for at least that long (and likely longer) to inject and push the code in the first place,” he said. “No code – malicious or otherwise – should ever make it into production without it being validated as legitimate first.”

Photo: Geograph.org.uk