Green Bay Packers' Online Pro Shop Sacked by Payment Skimmer

A Magecart-style payment-card skimmer was discovered on the Green Bay Packers Pro Shop e-commerce site; attackers injected a script (https://js-stats.com/getInjector) that exfiltrated checkout fields by abusing a JSONP callback and YouTube oEmbed to bypass the site's CSP. The skimmer was active in two windows (Sept 23–24 and Oct 3–23, 2024), exposed full payment card data plus names, addresses and emails for approximately 8,514 customers, and was served via a third-party hosted store.