European Space Agency’s Online Store Hacked: Payment Card Data at Risk

The European Space Agency (ESA), known for its ambitious space exploration missions, has found its official merchandise store caught in the crossfire of a sophisticated cyberattack. Hackers injected a malicious JavaScript code into the ESA web shop, redirecting customers to a fake Stripe payment page at checkout to steal sensitive payment card data.

---

What Happened?

The ESA’s official merchandise store was compromised when attackers introduced a fake payment processing system. Here’s a breakdown of the incident:

• Malicious JavaScript Script: The script loaded obfuscated HTML code mimicking Stripe’s SDK to generate a counterfeit Stripe payment page. This page appeared legitimate, as it was hosted within the ESA store’s domain, making it hard for customers to detect foul play.
• Data Exfiltration Domain: Hackers used a cleverly disguised domain name, identical to the official store’s domain but with a different top-level domain (TLD). While ESA’s store operates under “esaspaceshop.com,” the attackers used “esaspaceshop.pics” to exfiltrate stolen data.
• Customer Data Compromised: Sensitive payment card details were collected as customers completed purchases, creating significant risks for those affected.

---

Who Discovered the Breach?

The breach was identified by Sansec, an e-commerce security firm, which noticed the malicious script on the ESA’s site. Sansec warned that this issue could also pose a risk to ESA’s internal systems if integrated with the compromised store.

Additionally, Source Defense Research, a web application security company, confirmed Sansec’s findings by capturing evidence of the fake Stripe page in action.

---

ESA’s Response

The ESA clarified that the merchandise store is not hosted on its infrastructure and the agency does not manage the data collected by the store. This suggests a licensing arrangement where the store is operated by a third party.

Despite the ESA’s assurances, the malicious script remained visible in the web shop’s source code even after the fake payment page was removed. The store has since been taken offline, displaying a placeholder message: “temporarily out of orbit.”

---

Lessons for Businesses

This breach highlights the risks associated with outsourcing e-commerce operations, especially for high-profile organizations. Businesses must ensure that third-party stores adhere to strict cybersecurity protocols to safeguard customer data.

---

How Enterprises Can Protect Their Customers

1. Regular Security Audits: Conduct periodic reviews of all third-party platforms and integrations to identify vulnerabilities.
2. Code Monitoring: Use real-time monitoring solutions to detect unauthorized changes to website code.
3. Domain Verification: Implement strict domain verification practices to prevent look-alike domains from fooling customers.
4. Secure Payment Systems: Work with trusted payment providers and verify SDKs for tampering.
5. Customer Education: Inform customers about potential red flags, such as unexpected URLs or unfamiliar payment page designs.

---

Why Enterprises Should Consider Secure CDN Solutions

To prevent incidents like this, enterprises can benefit from using robust and secure content delivery networks (CDNs) like Goooood® SafeCDN. Goooood’s SafeCDN provides advanced features tailored to protect businesses and their customers:

• Real-Time Threat Detection: Identifies and blocks malicious scripts injected into your website.
• DDoS Protection: Guards against large-scale attacks that could compromise online stores.
• Data Encryption: Ensures all customer data is securely transmitted.
• Optimized Global Reach: With specialized return routes for China and international markets, Goooood SafeCDN ensures seamless and secure user experiences worldwide.
• Web Application Firewall (WAF): Filters and blocks malicious traffic to protect against sophisticated attacks like fake payment gateways.

By subscribing to a secure CDN solution like Goooood® SafeCDN, businesses can safeguard sensitive customer data, prevent fraudulent activities, and maintain their brand’s integrity in the face of cyber threats.

---

Protecting sensitive customer data isn’t just a security measure—it’s a responsibility. Choose Goooood SafeCDN for peace of mind and the ultimate in online protection.