RiskIQ: Magecart hacking group have found a way to scan for unsecured AWS S3 buckets, collecting 17,000 potential sites, some among the top 2,000 biggest sites
Brian Barrett / Wired :
Context & Ripple Effects
Magecart built its reputation on web-skimming: RiskIQ's earlier attribution of the British Airways breach tied the group, active since 2015, to tactics also seen in the Ticketmaster incident — injecting skimmers into payment pages rather than breaking into databases directly.
This new RiskIQ finding marks a shift in target selection: instead of compromising storefront software like Magento, where unauthenticated exploits and later zero-day attacks on Magento 1 stores kept thousands of merchants exposed, the group is now scanning for misconfigured AWS S3 buckets directly — a list of 17,000 candidate sites that includes some of the top 2,000 websites.
First-order effects
- Site owners whose buckets appear in Magecart's 17,000-site collection face immediate exposure of whatever payment or customer data sits in those stores, and under cloud providers' shared-responsibility models the misconfiguration — not AWS — is their liability to fix.
- Security teams at large e-commerce operators now have to treat open S3 buckets as a skimmer delivery vector, adding storage-permission audits to defenses previously focused on checkout-page scripts.
Second-order effects
- Rival card-skimming crews, such as the Keeper group behind hundreds of breached e-commerce portals, can replicate bucket-scanning at near-zero cost, turning one group's technique into commodity tooling across the underground.
- Cloud providers face pressure to harden defaults and surface misconfiguration warnings more aggressively, since each high-profile scan erodes trust in 'secure by default' storage claims.
Third-order effects
- If skimming groups keep automating discovery across both storefront software and cloud storage, the defense burden shifts from patching individual platforms toward continuous configuration auditing — the pattern behind later mass warnings like the UK NCSC's notice to over 4,000 stores running unpatched skimmer-vulnerable software (NCSC warning).
- Payment-card risk migrates upstream into infrastructure ownership: whoever controls the hosting layer, not just the checkout code, becomes the decisive security perimeter for e-commerce.
The trend: Card-skimming operations are industrializing from hand-planted JavaScript skimmers to automated scans of cloud misconfigurations, widening the attack surface from storefront code to the storage layer beneath it.