Malware: Online shop, international 2024
Shortly before Christmas 2024, the company Sansec discovered a script in the ESA shop that showed a fake payment page at checkout and captured card data.
- Incident · 12.2024 · Europe (ESA online shop, operated by a third-party provider), international
- Evidence: confirmed by an authority
- Malware
- Data breach
- Attack via a supplier
As of
What happened
The data went to a domain with an almost identical name ending in .pics. ESA took the shop offline temporarily and stressed that it was operated by a third-party provider.
- Affected
- Official online shop of the European Space Agency ESA
- Industry
- Online shop
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- no / no
- Data affected
- true
- Bankruptcy
- no
- Entry point
- Script injected into the shop that displayed a fake Stripe payment page (skimmer on a lookalike domain)
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Contractual penalties under PCI DSS for card payments
Mostly covered 4 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Online shops must keep their shop software up to date and monitor payment pages for third-party scripts, otherwise they are liable for stolen card data.