Massive Magento Cyberattack Compromises 7,500+ E-Commerce Sites Since February 2026 A large-scale cyberattack campaign has compromised over 7,500 Magento-powered e-commerce websites since late February 2026, with attackers uploading malicious files to publicly accessible web directories across 15,000+ hostnames. The campaign, tracked by Netcraft researchers, marks one of the most extensive Magento-focused attacks in recent years, affecting businesses, government agencies, universities, and non-profits worldwide. ### Scope and Impact The attack exploited a file upload vulnerability in Magento environments, allowing threat actors to deposit unauthorized files without authentication. Victims include high-profile brands such as Toyota, Fiat, Citroën, Asus, Diesel, Fila, Bandai, FedEx, BenQ, Yamaha, and Lindt, as well as government and university domains in Latin America and Qatar. Several Trump Organization-affiliated sites including trumpstore.com, trumphotels.com, and booktrump.com were also compromised, though researchers confirmed these were incidental targets in an indiscriminate sweep. Most defacements occurred on subdomains, staging environments, or regional storefronts, with only a few live customer-facing sites briefly impacted before remediation. Attackers left behind text files displaying aliases L4663R666H05T, Simsimi, Brokenpipe, and Typical Idiot Security alongside "greetz" messages, a common practice in defacement circles. A subset of defacements on March 7, 2026, included geopolitical messaging, though analysts determined this was not the campaign’s primary motive. ### Technical Details The attack leveraged an unauthenticated file upload flaw in Magento, enabling attackers to write files directly to web servers without credentials. Netcraft researchers successfully replicated the behavior on a Magento Community 2.4.9-beta1 test instance, demonstrating that even updated installations could remain vulnerable under certain configurations. The affected platforms include Magento Open Source, Magento Enterprise, Adobe Commerce, and Adobe Commerce with the B2B module. While Adobe released security bulletins around this period, the observed exploit does not directly align with the published fixes. The campaign shares similarities with the SessionReaper Magento vulnerability from October 2025, which also involved unauthorized file access. ### Attacker Activity and Documentation The threat actor behind the campaign, operating under the handle "Typical Idiot Security," self-reported many compromised sites to Zone-H, a public defacement archive. This suggests the attacker sought recognition within the defacement community rather than pursuing financial or political objectives. As of the latest reports, new compromised sites were still emerging, indicating the campaign remained active. Organizations running Magento-based infrastructure were urged to review file upload endpoints, apply security updates, and monitor web directories for unauthorized changes.

INC Ransomware Gang’s Security Failure Exposes Stolen Data from 12 U.S. Organizations In a significant operational security lapse, researchers at Cyber Centaurs, a digital forensics and incident response firm, uncovered data exfiltrated by the INC ransomware gang from 12 U.S. organizations across healthcare, manufacturing, technology, and service sectors. The discovery stemmed from an investigation into a ransomware attack on a U.S. client in November 2023, where the RainINC variant was deployed via the PerfLogs directory a Windows-created folder increasingly abused by threat actors for staging. During the forensic analysis, researchers identified remnants of the legitimate backup tool Restic, which the INC gang had used in previous attacks but not in the current incident. This led to a shift in focus toward the gang’s infrastructure, where hardcoded credentials, PowerShell scripts (including a Base64-encoded ‘new.ps1’ file), and backup commands revealed a pattern of long-term data retention. The gang had reused Restic-based storage repositories across multiple campaigns, leaving encrypted victim data accessible even after ransom negotiations concluded. Cyber Centaurs developed a non-destructive enumeration process to validate their hypothesis, confirming the presence of stolen data from unrelated organizations none of which were their clients. After decrypting the backups, the team preserved copies and coordinated with law enforcement to verify ownership and ensure proper handling. The investigation also exposed the gang’s broader toolkit, which included cleanup utilities, remote access software, and network scanners. To aid defenders, Cyber Centaurs released YARA and Sigma rules to detect Restic or its renamed variants in suspicious locations, potentially flagging early-stage ransomware activity. INC ransomware, a ransomware-as-a-service (RaaS) operation active since mid-2023, has targeted high-profile victims, including Yamaha Motor, Xerox Business Solutions, Scotland’s NHS, McLaren Health Care, and the Texas State Bar. This breach highlights the risks of reused attacker infrastructure and the potential for recovering stolen data even after an attack concludes.