Avery had credit card skimmer stuck on its site for months

Avery notified customers that a JavaScript credit card skimmer was active on its e-commerce site from July 18 to December 9, 2024, potentially exposing payment card details (including CVV), names, addresses, emails, phone numbers, and purchase data for about 61,193 people; affected customers have reported fraudulent charges and phishing. The article explains that card skimmers are typically injected via CMS or plugin vulnerabilities, illustrates detection/prevention measures (antivirus, browser extensions like Malwarebytes Browser Guard, monitoring financial statements and identity/credit monitoring), and links to further guidance on responding to a data breach.