Digital Attack Strikes 201 Online Campus Stores

  • By Dian Schaffhauser
  • 05/16/19
online credit card fraud

A digital attack recently hit 201 online campus stores, all running the same checkout software. A cybercrime group injected a version of Magecart, first reported by Trend Micro, into campus store websites to scrape credit card and other customer data during checkout, which was then sent to a remote server. All of the colleges and universities affected were running PrismWeb, an e-commerce platform designed specifically for college stores by PrismRBS. None of the institutions involved have been named.

Trend Micro disclosed its findings to PrismRBS in late April, which, according to a statement PrismRBS issued, "immediately took action to halt the current attack, initiated an investigation, engaged an external IT forensic firm to assist in our review [and] notified law enforcement and payment card companies." PrismRBS said it has also reached out to customers that have been hit.

This version of the Magecart attacks, named Mirrorthief by the security company, apparently forged a Google Analytics script, but then loaded its own script, which was responsible for stealing the payment information, according to an explanation by Trend Micro.

"To defend against this type of threat, website owners should regularly check and strengthen their security with patches and server segregation," advised Trend Micro. "Site owners should also employ robust authentication mechanisms, especially for those that store and manage sensitive data. IT and security teams should restrict or disable outdated components, and habitually monitor websites and applications for any indicators of suspicious activity that could lead to data exfiltration, execution of unknown scripts, or unauthorized access and modification."

PrismRBS was formed last year when Nebraska Book Company and the Collegiate Retail Alliance merged their point-of-sale and enterprise resource planning businesses.

About the Author

Dian Schaffhauser is a former senior contributing editor for 1105 Media's education publications THE Journal, Campus Technology and Spaces4Learning.

Featured

  • sleek fishing hook with a translucent email icon hanging from it

    Report Identifies Rise in Phishing-as-a-Service Attacks

    Cybersecurity researchers at Trustwave are warning about a surge in malicious e-mail campaigns leveraging Rockstar 2FA, a phishing-as-a-service (PhaaS) toolkit designed to steal Microsoft 365 credentials.

  • abstract design with shapes resembling open books and knowledge pathways, intertwined with circuit-like patterns

    New AAC&U Institute to Explore Challenges and Opportunities of AI in Teaching and Learning

    The American Association of Colleges and Universities (AAC&U) a new Institute on AI, Pedagogy, and the Curriculum designed to "help departments, programs, colleges, and universities respond effectively to the challenges and opportunities artificial intelligence (AI) presents for courses and curricula."

  • stylized illustration of a global AI treaty signing, featuring diverse human figures seated around a round table

    World Leaders Sign First Global AI Treaty

    The United States, the United Kingdom, the European Union, and several other countries have signed "The Framework Convention on Artificial Intelligence, Human Rights, Democracy, and the Rule of Law," the world's first legally binding treaty aimed at regulating the use of artificial intelligence (AI).

  • MathGPT

    MathGPT AI Tutor Now Out of Beta

    Ed tech provider GotIt! Education has announced the general availability of MathGPT, an AI tutor and teaching assistant for foundational math support.