E-commerce security: where customer data actually leaks

An online store holds a rare combination of data: name, phone number, delivery address, purchase history and payment habits. That is worth more on the black market than a plain email list. Meanwhile a typical store on an off-the-shelf platform with a dozen plugins has a wider attack surface than a bank. Let us look at where things tear most often.

Point 1. Third-party scripts on the payment page

Web skimmers inject a few lines of JavaScript that copy card details from the form before it is submitted. They usually do not arrive through your site: the attacker compromises a third-party service — a chat widget, a counter, a recommendations script — and the malicious code reaches you as an update. The defence: the payment form lives on the bank's side or in an isolated frame, and the payment page carries no third-party scripts at all. A content security policy with an explicit list of permitted sources blocks any attempt to load foreign code.

Point 2. Open APIs and enumerable identifiers

The most common audit finding: an endpoint like /api/orders/12345 returns an order without checking whether it belongs to the current user. By changing the number you can export the entire database with addresses and phone numbers in an hour. This is the classic vulnerability that ranks first in the OWASP Top 10. Checking is easy: log in with a test account and try to open someone else's order by direct link. We include this check in the mandatory checklist when building online stores.

Point 3. Exports and data dumps

• Feed files for marketplaces and product aggregators sitting in an open directory and containing more fields than they need.
• Excel reports that managers forward through messengers and to personal email.
• Database backups in the site root with a predictable name like dump.sql.
• A test environment holding a copy of the production database, reachable at test.yourdomain.ru with no password.
• Logs containing full request bodies, including personal data and tokens.

Point 4. Employee accounts

A departed manager keeps access for months, simply because disabling accounts is not built into the offboarding process. Every employee has full rights "just in case", including the ability to export the whole database. This is no longer a technical problem but an organisational one, and it is solved with role separation and a written procedure. We covered this in more detail in our article on access rights.

Point 5. Plugins and modules

An average store on an off-the-shelf CMS carries 20–40 extensions, some of which have not been updated in years and some bought on a third-party marketplace of unknown quality. Every extension runs with the application's full privileges and has database access. The rule is simple: any module that is not used should be deleted, not disabled — disabled code often remains reachable by direct URL.

The price of a leak, in roubles

Since 2025, fines under Article 13.11 of the Code of Administrative Offences for a personal data leak start at 3 million roubles for 1,000 or more data subjects and reach 15 million for over 100,000. A repeat offence shifts the penalty to turnover-based: 1% to 3% of annual revenue, with a minimum of 20 million roubles. Add to that the mandatory notification of Roskomnadzor within 24 hours of discovery, plus the reputational damage. Current versions of the rules are easiest to check on the legal information portal.

A checklist for this week

• Try opening someone else's order by direct link using a test account.
• Review the list of every third-party script on the checkout page.
• Find and close off test environments and open feed files.
• Reconcile the list of active accounts against the current staff roster.
• Delete unused modules and update the ones that remain.
• Enable two-factor authentication for all administrators.

An audit against this list takes one working day and usually turns up two or three findings in the "the data was sitting wide open" category. If you want an outside view, let us discuss the format, and examples of our commercial projects are in the portfolio.