Two paths through the same incident.
Without the Doppelgänger
- 1
Months before
An extension in the store is outdated, and its vulnerability is publicly known.
- 2
Break-in
Attackers inject a script into the checkout page that sends payment details to a third-party server.
- 3
3 to 6 weeks
Fraud cases pile up at the bank, all with one thing in common: your store.
- 4
72 hours
Notifying the data protection authority (Art. 33 GDPR), informing the people affected (Art. 34), forensics, talks with the payment provider.
- 5
Risk of a fine
In 2020, the data protection authority of Lower Saxony fined a company €65,500 solely for running outdated store software.
Customers who had to cancel their card rarely buy again.
With the Doppelgänger
- 1
Monthly
The plugin inventory spots the outdated extension, and every month the update is tested on the copy through to checkout, then installed.
- 2
Every night
Changed files stand out in the nightly file comparison. Scripts injected through the database are harder to detect, which is why closing the vulnerability quickly matters most here.
- 3
Always
Customer data on the copy is anonymized, so a test system never becomes a source of data itself.
Under the GDPR, a neglected website is not a cosmetic flaw. It requires security in line with the state of the art, from small businesses too.
What the incident costs.
More case studies
The full disk
For two days the store took no orders. The disk was full, and nobody noticed.
The host switches PHP versions
The host raised the PHP version. For three days the home page looked empty.
The checkout that is only broken sometimes
For three weeks, not a single purchase on invoice went through in the store for wholesale customers. The main store worked perfectly.
A typical course of events, assembled from real incidents. Figures are example calculations based on the stated assumptions.