Digital Attack Strikes 201 Online Campus Stores

  • By Dian Schaffhauser
  • 05/16/19
online credit card fraud

A digital attack recently hit 201 online campus stores, all running the same checkout software. A cybercrime group injected a version of Magecart, first reported by Trend Micro, into campus store websites to scrape credit card and other customer data during checkout, which was then sent to a remote server. All of the colleges and universities affected were running PrismWeb, an e-commerce platform designed specifically for college stores by PrismRBS. None of the institutions involved have been named.

Trend Micro disclosed its findings to PrismRBS in late April, which, according to a statement PrismRBS issued, "immediately took action to halt the current attack, initiated an investigation, engaged an external IT forensic firm to assist in our review [and] notified law enforcement and payment card companies." PrismRBS said it has also reached out to customers that have been hit.

This version of the Magecart attacks, named Mirrorthief by the security company, apparently forged a Google Analytics script, but then loaded its own script, which was responsible for stealing the payment information, according to an explanation by Trend Micro.

"To defend against this type of threat, website owners should regularly check and strengthen their security with patches and server segregation," advised Trend Micro. "Site owners should also employ robust authentication mechanisms, especially for those that store and manage sensitive data. IT and security teams should restrict or disable outdated components, and habitually monitor websites and applications for any indicators of suspicious activity that could lead to data exfiltration, execution of unknown scripts, or unauthorized access and modification."

PrismRBS was formed last year when Nebraska Book Company and the Collegiate Retail Alliance merged their point-of-sale and enterprise resource planning businesses.

About the Author

Dian Schaffhauser is a former senior contributing editor for 1105 Media's education publications THE Journal, Campus Technology and Spaces4Learning.

Featured

  • cybersecurity book with a shield and padlock

    NIST Proposes New Cybersecurity Guidelines for AI Systems

    The National Institute of Standards and Technology has unveiled plans to issue a new set of cybersecurity guidelines aimed at safeguarding artificial intelligence systems, citing rising concerns over risks tied to generative models, predictive analytics, and autonomous agents.

  • server racks, a human head with a microchip, data pipes, cloud storage, and analytical symbols

    OpenAI, Oracle Expand AI Infrastructure Partnership

    OpenAI and Oracle have announced they will develop an additional 4.5 gigawatts of data center capacity, expanding their artificial intelligence infrastructure partnership as part of the Stargate Project, a joint venture among OpenAI, Oracle, and Japan's SoftBank Group that aims to deploy 10 gigawatts of computing capacity over four years.

  • shield with an AI microchip emblem hovering above stacks of gold coins

    AI Security Spend Surges While Traditional Security Budgets Shrink

    A new Thales report reveals that while enterprises are pouring resources into AI-specific protections, only 8% are encrypting the majority of their sensitive cloud data — leaving critical assets exposed even as AI-driven threats escalate and traditional security budgets shrink.

  • blue and green network lines

    HPE Announces Agentic AI Enhancements to Mist Platform

    HPE recently announced new capabilities for its Juniper Mist platform that leverage agentic AI to enable more autonomous, intelligent, and proactive network operations.