Cyber Incident Victim: X-Cart
Date:
Oct 2020
Location:
United States of America
Summary
A ransomware attack targeted the e-commerce platform X-Cart, disrupting customer stores hosted on its systems after attackers exploited a third-party software vulnerability. The incident caused complete outages for some stores and hindered email alert functionality for others, primarily impacting shared hosting servers while leaving core systems unaffected. Operations were restored using backups without ransom payment, prioritizing customer recovery and system stability amid concerns over potential legal action. This event aligns with broader ransomware trends affecting hosting providers and data centers.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In late October 2020, e-commerce software provider X-Cart experienced a ransomware attack that disrupted operations for customer stores hosted on its platform. The incident occurred when attackers exploited a vulnerability in third-party software to infiltrate X-Cart’s store hosting systems. This compromise led to partial outages across the hosting infrastructure, with some stores becoming completely inaccessible while others faced operational issues such as failures in sending email notifications. The company’s Vice President of Marketing, Jeff Cohen, later confirmed the incident impacted only a small segment of their infrastructure—primarily shared hosting servers—while core systems remained unaffected. Service disruptions persisted until restoration efforts were completed, though the exact duration of downtime was not specified in public statements. The attack occurred amid a broader surge in ransomware operations targeting hosting providers and data center operators, placing X-Cart among other victims like Equinix and CyrusOne.
X-Cart’s parent company, Seller Labs, responded by restoring all affected customer websites from backups without paying the ransom demanded by attackers. Cohen emphasized that service recovery and system stability were prioritized over addressing potential legal repercussions, including references to a possible class-action lawsuit arising from the incident. By November 8, 2020, all customer sites had been fully restored, though the company did not disclose whether customer data was exfiltrated or the specific ransomware variant involved. Independent reports from PortSwigger’s The Daily Swig and ZDNET confirmed the operational restoration, noting X-Cart’s reliance on backup systems to circumvent ransom demands. The incident underscored vulnerabilities in third-party software integrations within hosting environments while highlighting the growing targeting of web infrastructure providers by ransomware groups during this period.