Save, lock, inform
With a store, every hour a tampered checkout keeps running counts. Still, as with any website: save first, then clean up.
- 01
Save the current state
A copy of all files and the database, exactly as they are now. The basis of the analysis and your evidence for the authority and your payment provider.
- 02
Lock access
Admin passwords, hosting, server and database, plus the API keys of payment providers, your inventory system and other interfaces.
- 03
Inform your payment provider
If the checkout could be affected. Your contract with the provider may include reporting obligations of its own.
- 04
Check the checkout
Do the cart and checkout pages load unknown scripts? If in doubt, put the store into maintenance mode for the time being.
- 05
Clarify data protection
If customer data could be affected, the 72-hour deadline for reporting to the authority is running.
How you notice
A tampered store often keeps working as usual. In one case investigated by Sansec, the skimmer was still active after four days, and even large companies take a median of 14 days to discover attackers (Mandiant, M-Trends 2026).
Questions from the bank
Several fraud cases whose common denominator is your store. Often the very first sign.
Card fraud reported by customers
Customers get in touch shortly after ordering from you.
Unknown scripts in the checkout
The checkout page sends data to an address that belongs neither to you nor to your providers.
Changed settings
New payment methods, different recipient accounts, changed prices.
New access
Administrators, integrations or API keys that nobody created.
Spam in large numbers
Suddenly lots of customer accounts or orders that do not look like real customers.
How card skimmers work
A skimmer is a small, injected script that reads along on the cart or checkout page as customers type and sends the data to a third-party server. Some display a fake payment form.
They are often injected not as a file but through the database: in theme settings, content blocks or fields for tracking codes. That is why a file check alone does not always find them.
Card details are entered in your store
The form sits on your checkout page. A skimmer reads every keystroke.
Payment with the provider
A redirect to PayPal or Klarna, or input fields from the provider: card details do not end up on your server. A fake form is still possible, and addresses and order data are in the store either way.
What to check in Shopware and in WooCommerce
- Shopware and all extensions up to date?
- Admin users, integrations and their API access
- Installed apps and plugins, including unknown folders under custom/plugins
- Shopping Experiences and theme settings for unknown scripts
- Payment method settings
Shopware publishes security advisories and patches, in 2026 for example for a vulnerability in the Store API, closed in 6.7.13.1 and 6.6.10.23 (Sansec, 2026). If the store still runs on Shopware 5, the vendor has not released security updates since July 2024; then the move to Shopware 6 is part of the solution.
- Everything from the “WordPress hacked” guide: administrators, plugins, theme, options, uploads folder
- Payment plugins: API keys and recipients
- Webhooks and connected services
- Cart and checkout templates in the theme
The steps for the WordPress side are covered in detail in the guide WordPress hacked.
Your obligations after a store hack
Reporting to the authority
If customer data could be affected, reporting within 72 hours of becoming aware is practically always required (Art. 33 GDPR). With a store, a risk to the people affected is rarely unlikely.
Informing the people affected
If the risk is likely to be high, for example when payment details or passwords were stolen, without undue delay (Art. 34 GDPR), with clear advice on what customers should do.
Fine imposed in 2020 by the data protection authority of Lower Saxony, Germany, because a company ran store software that had not received security updates for years (Lower Saxony DPA, 2020 activity report). The GDPR requires security in line with the state of the art (Art. 32), regardless of company size.
This is not legal advice. Bring in your data protection officer, and document every step.
Restoring and reopening
A backup only helps if it was definitely made before the break-in, and it brings the old vulnerability back. On top of that, all orders and customer accounts since the backup are gone. Cleaning up is usually the better way:
- 01
Clean up
Store software and extensions fresh from official sources; check the database for unknown scripts, administrators and integrations.
- 02
Renew access
New credentials and API keys everywhere, including those of the interfaces.
- 03
Update
Bring the store software and all extensions up to date and close the vulnerability.
- 04
Customer passwords
If password hashes are affected, have customers set a new password at their next login.
- 05
Test order
Reopen only after a test order with every payment method.
Prevention: how I handle it with the Doppelgänger
For Shopware stores there is the Doppelgänger for Shopware. Scripts injected through the database are harder to detect, which makes it all the more important that vulnerabilities are closed quickly and with testing.
Anonymized copy
An exact copy of your store on a dedicated server in Germany. Customer data is anonymized on every copy.
Tested through to checkout
I test updates to Shopware and extensions on the copy with a complete order before they go live.
Nightly security checks
A file comparison, a plugin inventory and a security check examine the live store. Unknown files and outdated extensions stand out.
Daily test order
Every morning a test order runs. A checkout that stops working is not first noticed by customers.
The same applies to WooCommerce with the Doppelgänger for WordPress, including a test through to checkout using the payment providers’ test modes. Learn more: Shopware 6 updates without downtime.
Under the GDPR, a neglected website is not a cosmetic flaw. It requires security in line with the state of the art, from small businesses too.
Quick answers.
Do I have to report a hack of my online store?
If customer data could be affected, as a rule yes: to the competent data protection authority within 72 hours of becoming aware of it (Art. 33 GDPR). For a store with customer accounts, orders and payments, a risk to the people affected is rarely unlikely. This is not legal advice; bring in your data protection officer.
How do I recognize a credit card skimmer?
Often not at first glance, because the store works normally. Signs are questions from your bank or payment provider about fraud cases with your store as the common denominator, customers reporting card fraud, and unknown scripts on the cart and checkout pages that send data to unknown addresses.
Do I have to inform my customers?
If the incident is likely to mean a high risk for the people affected, for example when payment details or passwords were stolen, yes, and without undue delay (Art. 34 GDPR). Say clearly what happened and what customers should do, for example have their card blocked or change their password.
Can I keep the store open during the cleanup?
As long as it is not certain that the checkout is clean, better not. Maintenance mode costs a few orders; a skimmer that keeps running costs customer data and trust. Reopen after the cleanup, new credentials, updated software and a test order.
Are payments through PayPal or Klarna affected too?
If customers are redirected to the provider's site to pay, or enter their details in an input field from the provider, card details do not end up on your server. That is still not an all-clear: a skimmer can display a fake payment form, and addresses and order data are in the store.
How do I keep it from happening again?
Update the store software and extensions promptly and with testing, remove extensions you do not need, limit access to what is necessary, and monitor changes to files and to the checkout. That is exactly what the Doppelgänger is for: updates on a copy with anonymized data, nightly security checks and, for Shopware, a daily test order.