Over 4,000 online retailers have been warned that their websites had been hacked by cybercriminals trying to steal customers' payment information and other personal information. 

Recommends

• Best VPN services
• Best security keys
• Best antivirus software
• The fastest VPNs

In total, the National Cyber Security Centre (NCSC) has identified a total of 4,151 retailers that had been compromised by hackers attempting to exploit vulnerabilities on checkout pages to divert payments and steal details.They alerted the retailers to the breaches over the past 18 months. 

The majority of the online shops that cybercriminals exploited for payment-skimming attacks were compromised by known vulnerabilities in the e-commerce platform Magento. Most of those affected and alerted to the compromises and vulnerabilities are small and medium-sized businesses. 

---

See also: A winning strategy for cybersecurity (ZDNet special report).

---

The NCSC revealed the number of businesses it has notified about customer data being stolen ahead of Black Friday. It urges all retailers to ensure that their websites are secure ahead of the busiest online shopping period of the year to protect their business -- and their customers -- from cybercriminals. 

"We want small and medium-sized online retailers to know how to prevent their sites from being exploited by opportunistic cybercriminals over the peak shopping period," said Sarah Lyons, deputy director for economy and society at the NCSC. "Falling victim to cybercrime could leave you and your customers out of pocket and cause reputational damage." 

One of the key things that online retailers can do to help prevent payments and personal data from being stolen is to apply the available security patches that stop cybercriminals from being able to exploit known vulnerabilities in Magento and any other software they use. 

"It's important to keep websites as secure as possible, and I would urge all business owners to follow our guidance and make sure their software is up to date," said Lyons. 

Applying security patches in a timely manner is just one of the things recommended by the NCSC's and British Retail Consortium's Cyber Resliance Toolkit For Retail. This kit was released in October 2020, but the information on keeping websites secure from cyberattacks is still very much relevant today. 

"Skimming and other cybersecurity breaches are a threat to all retailers," said Graham Wynn, assistant director for consumer, competition and regulatory affairs at the British Retail Consortium.

"The British Retail Consortium strongly urges all retailers to follow the NCSC's advice and check their preparedness for any cyber issues that could arise during the busy end-of-year period."

---

See also:Ransomware: It's a 'golden era' for cybercriminals -- and it could get worse before it gets better.

---

The compromised shopping websites were identified as part of the NCSC's Active Cyber Defence programme, which has been monitoring for vulnerabilities that could impact online retailers since April 2020. 

The NCSC has also reiterated advice to consumers on how to stay safe when shopping online. The advice includes being selective about where you shop, only providing necessary information, ensuring the payment system used is protected and keeping online accounts secure. 

More on cybersecurity

• Don't want to get hacked? Then avoid these three 'exceptionally dangerous' cybersecurity mistakes.
• Businesses don't know how to manage VPN security properly - and cybercriminals are taking advantage.
• Boards still aren't taking cybersecurity seriously, warns new NCSC boss. That means everyone is at risk.
• Businesses don't talk about being victims of cyberattacks. That needs to change.
• Cloud security in 2021: A business guide to essential tools and best practices.

Security

8 habits of highly secure remote workersHow to find and remove spyware from your phoneThe best VPN services: How do the top 5 compare?How to find out if you are involved in a data breach -- and what to do next

• 8 habits of highly secure remote workers
• How to find and remove spyware from your phone
• The best VPN services: How do the top 5 compare?
• How to find out if you are involved in a data breach -- and what to do next