Estimated reading time: 9 minutes
Holiday shoppers beware! Guardio found card skimmers on 215 online shops in October. CINI asked what protections those shops ran. Only seven enforced script rules, and none of the seven would have stopped the attack. Most skimmers were still live a month later.
About one in 195 online shops was hacked in October, Guardio Labs estimates. It scanned 2.38 million stores and put the hacked total at about 12,200. Its holiday shopping report just came out, ahead of Black Friday and the holiday shopping season.
Guardio sells browser security to consumers. Its report is written for shoppers. CINI asked about the merchants. Yuval Barkan, Guardio’s vice president of research and innovation, answered.
Card skimmers are the smallest of five schemes Guardio found on hacked shops. They are also the one that steals payment cards directly. A skimmer hides a shop’s real card form and draws a fake one. In a sealed test, 64 of the 215 shops captured a test card Guardio typed. Many did so before anyone pressed “Place order.”
Card Skimmers Met Almost No Script Controls
The card industry’s security standard, PCI DSS, has rules for scripts on payment pages. CINI asked whether the skimmed shops had such controls.
“Almost none of the skimmed shops had script protections that would have stopped the attack,” Barkan said.
Guardio checked each shop for a Content Security Policy, or CSP. That is a browser instruction that limits which scripts can run. Guardio could read it for all 215 October skimmer shops:
- 129 had no CSP at all.
- 60 had a CSP that doesn’t cover scripts. Most only told browsers to use secure connections.
- 19 had a “report-only” CSP, mostly Magento’s default. “It logs issues but blocks nothing,” Barkan said.
- 7 enforced a CSP with script rules.
All seven still allowed inline scripts, the method most of these skimmers use, Barkan said. On five of them, the skimmer captured Guardio’s test card anyway. It stored the card in a cookie on the shop’s own domain, “which a CSP can’t prevent.”
Barkan added three limits. Guardio saw headers on archived pages, which may differ from the checkout page. It can’t detect script-monitoring tools, another way merchants can meet the PCI rules. And not every shop had to comply.
In early 2025, the PCI Security Standards Council removed the two script requirements for some merchants, Barkan noted. Those are merchants that take payments only through an embedded payment frame or a redirect to a provider. “Not every shop here was strictly required to have these controls,” he said.
How Card Skimmers Get Around Hosted Payment Forms
A hosted payment form is supposed to keep card data away from the shop. The skimmer kits have an answer.
“The kits work around the hosted forms rather than breaking into them,” Barkan said. Some hide Stripe’s secure card frame and draw plain fields in its place. Others draw a fake card form in place of a different payment method. “Stripe is one target among several,” he said.
Among the 215 shops, 97 ran WooCommerce, and 31 ran OpenCart. Shopify accounted for 18 and Magento for 16. One ran PrestaShop. Guardio put 52 under “other.”
Shopify’s checkout runs on Shopify’s own pages. Planted code there “has to draw its own fake form to get a card,” Barkan said.
Guardio also listed the payment providers loaded on the archived pages. PayPal or Braintree appeared on 53, Stripe on 33 and Klarna on 30. Local bank gateways appeared on 20 and Mollie on 10. The archive usually holds a shop’s home or product page rather than its checkout, Barkan cautioned.
Of the 64 shops that took the test card, 36 read fields typed on the page. Twenty drew their own fake form. Eight used other methods.
Most Skimmers Were Still Live A Month Later
CINI asked how long a typical skimmer stays live. Guardio sees snapshots rather than infection dates, Barkan said. He gave minimums.
The October crawl fetched 164 of September’s skimmer shops again. Of those, 118 still carried skimmer code a month later. That is 72%.
Eighty-one shops were skimming in both crawls and still served the skimmer from Oct. 29 to 31. Those ran for “at least 6–8 weeks,” Barkan said.
Time matters because every day adds stolen cards. The report explains why owners miss it. Orders still go through. Many attacks hide from the owner and show only to first-time visitors or people arriving from Google. There are no complaints until customers find fraud on their cards, weeks later.
CINI asked whether Guardio told the shops, card brands or payment processors. “Any websites which were named in the research directly have been informed,” Barkan said. The report does not name shops. Guardio did not say whether it contacted card brands or processors.
The Bill Lands On The Merchant
Cardholders usually get their money back. The costs then travel to the merchant where the card was stolen. Card brands can levy assessments through the merchant’s payment processor to cover fraud and replacement cards.
Insurance doesn’t always follow. In 2016, a federal court in Arizona ruled on P.F. Chang’s cyber policy. The insurer had paid more than $1.7 million in breach costs. The court held it did not have to cover nearly $2 million in card-brand assessments. That is according to law firm Simpson Thacher’s summary. The assessments arose from a contract. The policy excluded contractual liability.
Regulators can add to the bill. Britain’s privacy regulator fined British Airways £20 million in 2020 over a card-skimming attack, The Register reported.
The shops in Guardio’s data are mostly small. Most small firms still don’t buy cyber cover, CINI has reported.
Get The Cyber Insurance Upload Delivered
Subscribe to our weekly newsletter!
A Hosted Platform Is No Guarantee
The report says shops running their own store software were hacked up to six times as often as hosted ones. Its chart shows Magento at one in 80 and Shopify at one in 520. That chart was drawn before error correction.
CINI asked for the corrected figures. Guardio supplied them for October:
- Self-hosted carts as a group: one in 123
- Magento: one in 75
- WooCommerce: one in 127
- BigCommerce: one in 127
- Shopify: one in 453
“After correction, BigCommerce’s October rate is about the same as WooCommerce’s,” Barkan said. The contrast between self-hosted and hosted shops “still works for Shopify, but not in the same way for BigCommerce.”
Shopify shops were hacked less than a third as often as self-hosted ones. BigCommerce’s figure rests on a smaller sample of about 14,200 stores. Guardio’s range for it runs from one in 107 to one in 148.
For an underwriter, “hosted” alone is a weak signal. Which platform matters.
What The Numbers Don’t Show
Hacked shops did not rise into the holidays. Guardio’s estimate fell from about 15,100 in September to 12,200 in October. Four of the five schemes shrank. The risk Guardio describes is persistence. Of September’s hacked shops it could check again, 62% were still hacked in October.
A second figure measures something else, Barkan said. Guardio visited October’s hacked shops on Oct. 29 to 31. At least 28% were still serving the attack on the live web. The two figures cover different groups and are not directly comparable, he said.
AI models did the flagging. AI reviewers checked them. CINI asked whether a person checked any sample. Guardio ran a human audit of 150 positive decisions out of 611 full-chain attacks, Barkan said. “We found zero false positives.”
One scheme reaches past the shopper. About 900 shops showed a fake “I’m not a robot” check in October. It tricks visitors into installing software that steals saved passwords and browser logins. An employee shopping on a work laptop could hand over company logins. CINI asked whether any stolen logins were corporate.
“We only monitored the compromised sites which contain the credential stealing code,” Barkan said. “We cannot know who has been compromised.”
Guardio followed 10 command templates from those checks on Oct. 30 and 31. Three delivered malware. One refused the request. Six were dead, though shops still showed five of those to visitors.
More From CINI: The Default Nobody Checks
Some skimmed shops ran a platform default that logs problems and blocks nothing. Office printers share that weakness. Symphion CEO Jim LaRoe says almost none are protected. Technicians often reset them to factory settings after a repair. “We say one printer can take down a whole company,” LaRoe said on the CINI podcast. He also covers what cyber insurance applications miss. Symphion sells printer security.
Watch on YouTube | Listen on Spotify | Listen on Apple Podcasts | Read the story
FAQ – Card Skimmers
What are card skimmers on online shops?
Hidden code on a payment page that copies card details. Many hide the real card form and draw a fake one in its place.
How many online shops had card skimmers?
Guardio found 215 in October 2026 and 250 in September, out of about 2.38 million stores scanned.
Did the shops have script controls?
Almost none. 129 of 215 had no Content Security Policy. Only 7 enforced script rules, and all 7 still allowed inline scripts.
How long do card skimmers stay live?
Of 164 September skimmer shops checked again, 72% still carried the code a month later. Eighty-one ran one for at least six to eight weeks.
Who pays when card skimmers steal cards?
Costs usually travel back to the merchant through card-brand assessments. A 2016 court ruling found one cyber policy did not cover them.
Are hosted shop platforms safer?
Shopify shops were hacked far less often, at one in 453. After error correction, BigCommerce matched WooCommerce at one in 127, Guardio told CINI.
Related Cyber Insurance Posts
- An Intruder Spent At Least Nine Days Inside Backup Servers. A Patch Wouldn’t Have Removed It, Huntress Says.
- Holiday Scams Rise as Cybercriminals Target Retailers During Peak Shopping Weeks(Opens in a new browser tab)
- Cyber Insurance for Small Business: Shopify Has Just Named it a Necessity for 2026(Opens in a new browser tab)
- From Credit Card Losses to Psychiatric Fees, BOXX Offers Coverage for Personal & Family Expenses from Cyber Attacks(Opens in a new browser tab)
- Insurers Focus on Cyber Coverage to Boost Auto and Property Profits(Opens in a new browser tab)