Global Hacking Campaign Defaces 7,500+ Magento Sites

Since February 27, 2026, hackers have defaced over 7,500 Magento-powered websites, targeting e-commerce platforms, government services, and various organizations. The attackers uploaded plaintext defacement files and hidden malicious files into publicly accessible directories across more than 15,000 hostnames. The campaign has impacted commercial brands, government agencies, universities, and non-profit organizations across multiple countries. Cybersecurity firm Netcraft reported the attacks as opportunistic, indicating a lack of sophisticated targeting. The full scope of the data theft and potential vulnerabilities exploited remains unclear. As of March 20, 2026, the attacks are ongoing, with no specific remediation steps detailed in the articles. The incident highlights the vulnerabilities within Magento platforms and the need for enhanced security measures.

Key Points: • Over 7,500 Magento sites have been defaced since February 27, 2026. • Attackers uploaded files to over 15,000 hostnames, affecting various sectors. • The campaign is characterized as opportunistic, with no advanced targeting methods reported.