Loading story…
Some Click2Mail customers are expected to receive notifications of a data-security incident after allegations that the company’s debit-card checkout process was actively hijacked. A source who contacted DataBreaches via Signal said payment-card details were exposed and sold to fraudsters.
The source alleged that the compromise occurred first on June 2 and again at a later, unspecified time. The available reporting does not independently confirm the allegations and does not identify an attacker, intrusion method, number of affected customers, or the precise scope of potentially exposed card data.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
DataBreaches reported that some Click2Mail customers would soon receive notification of a data-security incident. The reporting did not identify a threat actor, intrusion vector, or number of affected customers.
An individual contacted DataBreaches via Signal and alleged that Click2Mail's debit-card checkout process was actively hijacked and that card information was sold to fraudsters.
An individual alleged that Click2Mail.com's debit-card checkout process was hijacked on June 2, resulting in payment-card details being sold to fraudsters. The allegation was not independently confirmed in the cited reporting.
The same individual told DataBreaches they experienced the alleged Click2Mail debit-card checkout compromise twice, with the second occurrence at an unspecified later date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Target, Neiman Marcus, and Home Depot disclosed major payment-card breaches in which attackers planted **point-of-sale malware** on in-store checkout systems and harvested customer data at scale. Target said about **40 million** payment cards were exposed during the 2013 holiday shopping period, with later estimates rising to as many as **110 million** people affected when personal information was included. Reporting tied the Target intrusion to customized memory-scraping malware related to **BlackPOS**, which was used to collect card data from checkout terminals and stage it on internal servers before exfiltration; investigators and the U.S. Secret Service were drawn into the case as the breach became one of the largest retail compromises on record. Neiman Marcus also reported that its breach was worse than first disclosed, adding to the wave of retail intrusions. Home Depot later revealed a similarly large compromise affecting its U.S. and Canadian self-checkout systems, saying attackers stole more than **56 million** payment card numbers and over **53 million** email addresses after entering through credentials taken from a third-party vendor and moving laterally through the network. The incidents intensified pressure on U.S. retailers and payment providers to move away from vulnerable magnetic-stripe cards toward **EMV chip** technology, while also imposing steep business costs: Target reported a sharp profit decline, tens of millions of dollars in breach-related expenses, and warned that litigation, fraud losses, and investigative costs could continue to materially affect results. Together, the breaches showed how weak vendor access controls, hard-to-detect POS malware, and outdated payment technology enabled large-scale theft of card data from major retailers.
Jun 29, 2026
A Magecart campaign compromised **3,126 online shops** hosted on Volusion’s cloud e-commerce platform by tampering with the `vnav.js` JavaScript library used during checkout. The injected code loaded a second-stage skimmer from Google Storage, captured payment and personal information entered by customers, obfuscated the data, stored it in browser `sessionStorage`, and later exfiltrated it with HTTP `POST` requests to the lookalike domain **`volusion-cdn[.]com`**. Volusion said a limited subset of merchant customer information, including credit card data, was exposed. Researchers linked the operation to **Magecart Group 6 / FIN6** based on code and infrastructure overlaps with earlier e-skimming incidents involving **British Airways** and **Newegg**. The campaign reflected broader web-skimming tradecraft in which attackers inject malicious JavaScript into trusted payment pages to silently harvest checkout data at scale. Google removed the hosted malicious file, and Volusion acknowledged the compromise and said it had fixed the issue.
Aug 15, 2026
Mailchimp disclosed that attackers used social engineering against employees and contractors to steal credentials and access an internal customer support and account administration tool, leading to unauthorized access to **133 customer accounts**. The company said it detected the activity on January 11, suspended affected accounts, and notified impacted customers within 24 hours. Mailchimp added that **passwords and payment card data were not exposed**, but the compromised account information could still be used for targeted phishing and other follow-on attacks. The incident echoed an earlier Mailchimp breach in which intruders again manipulated employees to gain access to internal tools and target customers in the **cryptocurrency and finance** sectors. In that earlier case, attackers compromised **319 accounts**, exported audience data from **102 accounts**, accessed some customer API keys that were later disabled, and used the stolen data to send phishing emails, including messages aimed at **Trezor** users that impersonated breach notifications. The repeated intrusions highlighted the downstream risk posed by marketing platforms that hold customer contact data and administrative access across many organizations.
Jun 29, 2026