E-commerce Platform X-Cart Hit with Cyberattack

X-Cart, a company that provides e-commerce software and services, fell victim to a ransomware attack in late October. According to the Daily Swig, who first reported the incident following a tip-off from a participant on the message board, the attackers managed to breach X-Cart’s store hosting systems by exploiting a third-party software vulnerability. As a result, several customer stores that use the platform’s software were completely down or suffered disruptions.

The anonymous tipster revealed that the e-commerce software provider had to restore systems from backups, but data may be lost due to a time gap since the last restoration. Systems were “down for several days. There were customers restored with missing order information and settings changes.” The attack also affected email servers, the informant added.

Jeff Cohen, Marketing Vice President at Seller Labs, the company behind X-Cart, confirmed on October 29 that servers were down due to a ransomware attack. “The vulnerability was in a 3rd party software tool we used to manage our service infrastructure. We have removed this tool from our systems and are working with a security firm to confirm the source of entry and identify the ransomware strain,” he added. However, in an email to ZDNet, he stopped short of disclosing the tool’s name, preferring to wait until the investigation is complete. 

Cohen stated that the cybercriminals accessed a small number of servers and encrypted them, which caused the shut down of several stores, while others couldn’t send email alerts. Meanwhile, the ransomware offensive didn’t affect X-Cart’s core systems, impacting a small part of the infrastructure instead. Since then, all customer websites have been restored, assured Cohen.

Nonetheless, some store owners were far from happy with the disruption to their business and want to file a class-action lawsuit against the software provider. Cohen said Seller Labs and X-Cart are keeping their communication channels open with all customers affected by the incident and encouraged them to contact support for help or questions.

Several online sources offer cybersecurity help, news, and tools. TheVPN.Guru is home to the latest VPN reviews and guides, as well as online safety tips and tricks