Ecommerce security: ransomware-as-a-service, fraud, backups

In short: ecommerce security comes down to five habits: patch plugins, themes and apps quickly, put two-factor authentication on every account, keep offline backups you have actually restored, watch the scripts running on your checkout page, and train your staff to spot phishing. Ransomware-as-a-service makes attacks more frequent; AI helps you spot them sooner.

Ransomware shows up in 48% of the breaches analysed in Verizon's 2026 DBIR, and 31% of breaches start with a software vulnerability.
On WordPress, 96% of the new vulnerabilities reported in 2024 were in plugins, not in core.
A backup only counts if it lives away from the site and you have tested the restore.
AI is good at flagging unusual logins, orders and traffic. It does not replace patching, backups or strong authentication.

When you sell online, a successful attack has an immediate, visible cost: the store goes down, orders stop, customer data leaks, and B2B buyers start asking awkward questions. Their trust takes far longer to rebuild than the site. IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at USD 4.99 million, up 12% on the previous year. A typical online store will not get near that figure, but three days offline in peak season is enough to hurt. Below are the threats and fixes for Shopify and WordPress, in order of priority.

What is ransomware-as-a-service, and why does it hit online stores?

Ransomware is malicious software that encrypts a company's data and demands payment to restore it. Ransomware-as-a-service (RaaS) is how most of it is distributed today: one criminal group builds the ransomware and rents it out to others, the affiliates, who run the attacks and split the ransom with the developers.

The UK's National Cyber Security Centre calls RaaS the business model it sees most often. Groups give affiliates a web portal to customise the ransomware, and many add a platform for handling ransom negotiations. Around them sit initial access brokers, who collect and resell access to networks, admin panels and accounts that someone has already broken into.

The model works like a franchise: the developers supply the tools, the infrastructure and the "brand", and affiliates bring the attacks and hand over a share of each ransom. According to the NCSC, specialisation, easy-to-use tools and online criminal marketplaces and forums have lowered the barrier to entry. Writing ransomware is not technically hard, and the source code of well-known families such as LockBit 3.0 and Conti has leaked so widely that anyone can use it. The more organised groups run like real companies, with offices and salaries; smaller groups working together can still do serious damage.

For an online store, you do not need to be an "interesting" target. A resellable way in is enough: an outdated plugin, a password a freelancer reuses elsewhere, a hosting panel without two-factor login.

Then there is double extortion: before encrypting anything, attackers copy your data (customer records, orders, dealer-only price lists) and threaten to publish it. The NCSC also notes groups that steal and extort without deploying ransomware at all. A backup gets you back online; it does not pull leaked data back in.

Role in the RaaS model	What they do	What it means for you
Developer (operator)	Builds the ransomware, runs the portal and the leak site	Tools keep improving and reach anyone who pays
Initial access broker	Collects and sells access to sites, servers and accounts	A password stolen today can be used by someone else weeks later
Affiliate	Breaks in, copies data, triggers encryption, negotiates	The attack comes from whoever found the weak spot, not from someone who picked you

What are the real threats to an online store or B2B business?

Four threats actually take an online store down: ransomware, stolen credentials, card data skimmed in the browser (e-skimming) and order fraud. In the vast majority of cases they get in through one of two doors: a person who gets tricked, or software that was not updated.

ENISA's ETL 2025 report, based on 4,875 incidents between July 2024 and June 2025, names phishing as the leading way in, at about 60% of cases, followed by vulnerability exploitation at 21.3%. The same report calls ransomware the most impactful threat in the EU. Verizon's 2026 DBIR, meanwhile, records a shift: 31% of breaches now start with a software vulnerability, ahead of stolen passwords.

Threat	Usual way in	Impact on an online store	First line of defence
Ransomware	Vulnerable plugin, remote access or compromised hosting	Store and back office down, data encrypted and copied	Patching and offline backups
Credential theft	Phishing email to whoever runs the store	Access to the admin, orders and customer data	Two-factor login on every account
E-skimming	Script added to or altered on the checkout page	Card details stolen as the customer pays	Script inventory and monitoring
Order fraud	Stolen cards, hijacked customer accounts	Chargebacks, lost goods, payment account restrictions	Fraud rules and checks on unusual orders

A B2B example: a distributor with a dealer portal, custom price lists and repeat orders. If a sales rep uses the same password for email and the portal, a single successful phishing email exposes prices, terms and contact details for the whole dealer network. The damage is commercial before it is technical.

How to secure a Shopify or WordPress store: the checklist

The main difference is who is responsible for what. On Shopify, servers, platform updates and checkout are handled by Shopify; accounts, installed apps and theme code are still yours. On WordPress and WooCommerce, almost everything is on you or whoever manages the site.

The number that sets WordPress priorities comes from Patchstack: 7,966 new vulnerabilities were reported in the WordPress ecosystem in 2024, 96% in plugins and 4% in themes, with only seven in core. A third (33%) were still unpatched when they were publicly disclosed, and exploitation can start within hours. If your store runs on WordPress, the guide to AI in business CMS platforms covers how to vet plugins and extensions before you install them.

Shopify

Two-step authentication required for the owner and every staff account.
Least privilege: whoever handles orders does not need access to payments and settings.
Quarterly app review: remove what you do not use and check what data each app can read.
Check scripts added to the theme by apps and agencies, especially tracking scripts.
Regular exports of products, customers and orders, or a dedicated backup app: Shopify protects the service, not your data from a staff member's bad edit.

WordPress and WooCommerce

Core, plugin and theme updates on a fixed schedule, and immediately for critical flaws.
As few plugins as possible: each one is third-party code you have to maintain.
Two-factor login and unique passwords for admins, hosting, FTP and database.
File editing from the dashboard switched off, and admin access restricted.
A web application firewall and regular file scans.
Automatic daily backups stored off the web server.

For both: the payment page

PCI DSS v4.x includes two requirements aimed at e-skimming, 6.4.3 and 11.6.1: payment page scripts must be authorised, checked for integrity and monitored for tampering. In practice, that means keeping a list of every script running at checkout, knowing who added it, and getting an alert when something changes. The same applies if you add B2B payment methods to your store.

Why does staff training matter as much as technology?

Because the most common way in is a person. With phishing ranked by ENISA as the leading initial access vector, an email opened by whoever handles orders, customers or suppliers carries as much risk as an outdated plugin. CISA's #StopRansomware Guide recommends an awareness and training programme that teaches people to recognise and report suspicious activity, repeated regularly, along with an "external" tag on emails from outside the company.

The NCSC also explains why two-factor login makes training less fragile: credentials harvested by malware known as stealers are traded on criminal forums, and multi-factor authentication on remotely accessible accounts makes them much harder to use. For an ecommerce team, useful training is short and concrete:

The lures typical of the sector: fake notices from couriers, payment providers, the store platform or a marketplace, linking to copied login pages.
Bank detail changes: in B2B, an email from a supplier or customer announcing new bank details is always checked with a phone call to a number you already have.
Signs of compromise: an account sending emails nobody wrote, passwords that suddenly stop working, sign-in alerts from unknown devices.
How and where to report: one channel, one named contact and no blame for whoever reports a mistake. A click admitted straight away costs far less than a hidden one.

Backups and updates: how do you set them up so they actually work?

A backup works when three things are true: it is separate from the site, it is encrypted, and you have tested the restore. CISA's #StopRansomware Guide recommends offline, encrypted backups of critical data, with regular checks on availability and integrity, because many ransomware strains hunt down and delete any copies they can reach over the network. The NCSC confirms that most ransomware includes features to delete local backups precisely to hinder recovery.

The most common rule of thumb is 3-2-1: three copies of your data, on two different types of storage, with one off-site and out of the site's reach. For an online store, back up the database (orders, customers, products), site files, configuration and the part everyone forgets: integrations such as API keys, webhooks, shipping and tax rules.

Split updates into two tracks. Security updates go live within days, or within hours if the flaw is already being exploited. Feature updates get tested on a copy of the site (staging) first. The rush on security patches has a clear reason: according to the NCSC, in most cases an exploit for a newly patched flaw is circulating on criminal forums less than a week after the patch is released, because attackers study updates to work out what to exploit.

What role does AI play in threat detection?

Traditional security is reactive: you step in after the attack, once the damage has started. AI shifts the work towards prevention, because it continuously analyses logins, traffic, transactions and file changes, and flags suspicious behaviour before it becomes an incident. It is mainly useful for catching what manual checks miss: a 3 a.m. login from an unusual country, a burst of orders with different cards from the same device, a theme file changed outside a planned release.

IBM's 2026 report estimates average savings of USD 1.93 million for organisations that make extensive use of AI and automation in security, compared with those that use none. For an online store, three uses are concrete:

Order fraud scoring: models that rate each order's risk based on device, address, history and purchase speed.
Login analysis: alerts on unusual sign-ins to the store admin, hosting or ERP.
File and script monitoring: flags for unexpected changes, checkout first.

You do not always need a separate project. Some of these functions already sit inside the services an online store uses: Stripe, for example, describes its Radar product as AI-based fraud detection built on Stripe's global network. The first practical step is often to switch on and properly configure what your platform and payment provider already offer, and only then look at dedicated tools, measuring what they return.

Attackers use the same technology. ENISA reports that by early 2025, AI-supported phishing campaigns made up more than 80% of observed social engineering activity worldwide: better-written, personalised emails without the mistakes that used to give them away. AI alerts pay off when they feed an automated workflow that opens a ticket or locks an account, as shown in our piece on business process automation. To judge whether a tool is earning its keep, use the same yardsticks as any KPI for measuring AI value: time to detect, false positives, fraud blocked.

How can you tell if your online store has been hacked?

Ransomware announces itself, with unreadable files and a ransom note. Other intrusions do not: an e-skimmer can stay active for weeks while the store appears to run normally. That is why it pays to know which signals to watch and who might notice before you do.

The first free check is Google Search Console: if Google finds that the site has been compromised or behaves in ways that could harm visitors, for example through phishing or malware, the Security Issues report shows it, and affected pages may be labelled with a warning in search results or preceded by a warning page in the browser.

Signal	What it may mean	What to check first
Several customers report unusual card charges after buying from you	E-skimming at checkout	Payment page scripts and recent theme changes
Admin users, apps or plugins nobody remembers adding	Unauthorised access to the admin	Access logs, user list, app permissions
Redirects to other sites, or indexed pages you never created	Altered site files, injected spam	Search Console, recently modified files, database
A Google or browser security warning on your domain	Site flagged as compromised	Security Issues report in Search Console
Emails sent from your domain that nobody wrote, passwords that no longer work	Email account or admin panel breached	Recent sign-ins, mail forwarding rules, two-factor login

If you spot any of these signals, treat it as an incident and follow the steps in the next section: cleaning the site without finding out how they got in usually means facing the same problem a few weeks later.

What should you do in the first 24 hours of an attack?

In the first hours, isolate, preserve and communicate, in that order. CISA recommends a written, rehearsed incident response plan, kept on paper and offline too, because company systems may be unreachable during an attack.

Put the store into maintenance mode and isolate affected systems, ideally without powering them off, to preserve evidence.
Change admin, hosting and email credentials from a clean device, and turn on two-factor login wherever it is missing.
Notify your host or platform, your payment provider and whoever manages the site technically.
Check with your privacy adviser whether personal data was breached: under the GDPR, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put anyone at risk.
Before you even think about the ransom, check whether a free decryption tool exists: the No More Ransom project, backed by Europol and the Dutch police, collects decryption tools and advises against paying.
Report the crime to the police; in Italy, the Polizia Postale portal also lists the information to provide when reporting unauthorised access to a computer system. If you have cyber insurance, tell your insurer straight away: CISA lists the insurer among the parties to involve.
Restore from a backup taken before the intrusion, and only after closing the hole they came in through, or the attack will repeat.

If your company falls under NIS2, the privacy notification comes on top of reporting significant incidents to CSIRT Italia, as explained in the next section.

Does NIS2 apply to your B2B online store?

It depends on your sector and company size, not on whether you sell online. Italy's Legislative Decree 138/2024, which transposes the NIS2 directive, has been in force since 16 October 2024, and the National Cybersecurity Agency (ACN) is the competent authority. It covers 18 sectors, including parts of manufacturing, food production, processing and distribution, and digital service providers. It applies to medium and large companies; small and micro businesses are generally out of scope unless the authority designates them.

For companies in scope, the obligations cover the entire IT estate: the B2B portal or online store of a mid-sized manufacturer is part of it. According to the ACN, registration or its update takes place between 1 January and 28 February each year, the duty to report significant incidents to CSIRT Italia applies from January 2026, and the baseline security measures must be in place by October 2026. The areas covered include risk management, corporate accountability, business continuity and supply chain security.

Even if your company is out of scope, NIS2 can reach you through your customers: companies subject to it have to look after their suppliers' security, so they may ask you for assurances on backups, access control and incident handling. Having the measures in this article already documented makes those requests much easier to answer. Confirm whether you are in scope with a legal adviser, using the decree and the ACN's own tools.

How to apply this in your business: first steps

Take a typical scenario: a B2B spare parts store on WooCommerce, 30 plugins installed, four people with admin access, a daily backup saved on the same server as the site. This is where I would start, with a measurable result for each step.

Inventory in one week: list accounts, plugins or apps, checkout scripts and integrations, with an owner for each. Target: no line without a name next to it.
Two-factor login on 100% of accounts: store admin, hosting, domain, email and payment provider, within 15 days.
Backups moved off the server, plus a full timed restore test on a staging environment. The measured time becomes the maximum downtime you report to management.
An update calendar: one fixed day a week, plus a rule for critical flaws (within 48 hours). Fewer plugins at the end of the quarter than at the start.
Automated alerts: unusual logins, file changes and high-risk orders routed to a named person, with an agreed response time.

If the store is also your main channel to dealers, read these measures alongside the platform choices covered in our guide to the future of B2B ecommerce and the one on running a secure, tech-driven online store.

Mistakes to avoid

Keeping backups on the same server as the site: ransomware encrypts them along with everything else.
Treating Shopify as "secure by default": the platform protects its infrastructure, not your staff accounts or the apps you install.
Delaying updates for fear of breaking the site: the fix is a staging environment, not waiting.
Relying on AI alone: a detection tool without backups or a response plan only tells you the damage is under way.
Leaving former staff and agency accounts active: they are among the easiest access points to resell.

Frequently asked questions (FAQ)

What is ransomware-as-a-service in simple terms?

It is a model where the people who build ransomware rent it to other criminals, called affiliates, who carry out the attacks and share the ransom with the developers. It lowers the skill needed to attack, so the number of attacks goes up. For an online store, risk depends on the site's weak spots, not on the size of the company.

Is Shopify more secure than WordPress for ecommerce?

Shopify gives you less to manage, because servers, platform updates and checkout are the provider's job. WordPress with WooCommerce gives you more control and more responsibility: plugins, themes, hosting and backups are on you. Both become insecure with accounts lacking two-factor login and unchecked scripts.

How often should I back up my online store?

For a store taking orders every day, back up the database at least daily, and more often during peak periods. Keep at least one copy off the server, out of the site's reach. Test a restore at least once a quarter and time how long it takes to get back online.

Should you pay the ransom?

Paying guarantees neither a working key nor the deletion of stolen data, and the NCSC points out that it does not necessarily shield you from GDPR fines for the breach. Verizon's 2026 DBIR finds that businesses frequently choose not to pay and that ransom amounts are falling. The decision belongs with your legal and technical advisers, but a tested offline backup is what spares you from making it under pressure.

Is artificial intelligence enough to protect an online store?

No. AI is effective at detecting unusual logins, orders and changes, and it shortens the time an attack goes unnoticed. It does not fix vulnerabilities, replace two-factor login or recover encrypted data. Treat it as an extra layer on top of updates, backups and a response plan.

What am I legally required to do after a customer data breach?

If personal data is involved, EU and Italian rules require the controller to notify the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to put anyone at risk. If the risk to individuals is high, affected customers must be told as well. Document straight away what happened and what you have done about it.

How do I know if my online store has been hacked?

The most common signs are customers reporting unusual card charges after buying from you, users or plugins nobody added, redirects to other sites, indexed pages you never created and emails sent from your domain that nobody wrote. Also check the Security Issues report in Google Search Console, which flags sites Google considers compromised. If you find any of these signs, treat it as an incident before you clean up the site.

Sources

If you want to know where your store is most exposed and which fix to tackle first, book a free diagnosis.