WooCommerce Payment Logs - 300+ Live Stores with Stored Credit Card Data (July 2026)

[Blacksec]

WOOCOMMERCE PAYMENT LOGS ​

---

300+ WooCommerce stores compromised. Full payment logs extracted before deletion.

---

What These Logs Contain:

• Customer full name + email + phone
• Billing address + shipping address
• Full credit card data (number, expiry, CVV)
• Cardholder name + bank name (when available)
• Order amount + date
• Transaction ID for refund fraud

---

Stats:

Total stores compromised: 347
Total records: 28,491
US stores: 142
UK stores: 89
EU stores: 76
CA/AU: 40

Card types:
  Visa:     42%
  Mastercard: 35%
  Amex:     13%
  Discover:  10%

Avg order value: $87
Max single order: $2,400
Min: $12

---

How We Got Them:

1. WordPress vulnerability scanning (old plugins/themes)
2. WooCommerce payment gateway misconfiguration
3. Direct database access via exposed phpMyAdmin
4. Admin panel brute force (weak passwords on /wp-admin)

---

Full Dataset: $200

• CSV format (easy to parse)
• JSON format (for automation)
• Raw SQL dump (for direct import)

---

These are first-party logs, not generated. Use within 72 hours — some cards may be cancelled after the breach is discovered.