European Space Agency's official store hacked to steal payment cards

The European Space Agency's official web shop was compromised by injected obfuscated JavaScript that loaded a fake Stripe payment page to skim customers' payment card data. Security researchers identified a spoofed exfiltration domain (esaspaceshop.pics) used by the script; the code has since been removed and the store's hosting relationship with ESA indicates the shop is externally managed, which may limit direct agency data exposure but introduces supply-chain and employee risk.