The crooks are scanning the web for vulnerable Amazon Web Services S3 buckets, according to security vendor RiskIQ.

RiskIQ has found at least five different attack campaigns tied to the perpetrators of the apparent Wipro breach.

Flashpoint detailed an active Magecart-style campaign sweeping up data from more than 100 sites.

The attack bears similarity to Magecart activity, but researchers say a new Magecart group is behind it.

A card-skimming campaign affected an additional window of time beyond what the company first reported. But the number of accounts exposed from that first breach is smaller than initially reported.

RiskIQ says certain factors limited the scope of this compromise, and there are lessons learned as to how to avoid it.