The attack bears similarity to Magecart activity, but researchers say a new Magecart group is behind it.

A card-skimming campaign affected an additional window of time beyond what the company first reported. But the number of accounts exposed from that first breach is smaller than initially reported.

RiskIQ says certain factors limited the scope of this compromise, and there are lessons learned as to how to avoid it.

Researchers say the hacking group is getting better at finding ways to leverage faults in Javascript to hide and carry out breaches of credit card payment systems.

A RiskIQ researcher says targeting third-party web apps is the "supply chain attack for the web."

RiskIQ and Proofpoint's findings reveal not only newly discovered, highly sophisticated tactics and capabilities held by North Korea's Lazarus Group, but they also highlight the internal divisions within it.