Alpaca Forms

Alpaca Forms is an organization that operates under that alias and is headquartered in the United States of America. Publicly available sources provide limited detail about its primary products or services. The entity is noted in cybersecurity reporting as a vendor whose servers were compromised in a notable supply‑chain attack. This involvement places Alpaca Forms within the broader ecosystem of third‑party service providers that can be leveraged by threat actors. No further specifics about its size, market reach, or ownership are disclosed in the available material. Consequently, the profile focuses on the confirmed facts surrounding its participation in the 2019 incident.

On May 12, 2019, attackers breached the servers of Alpaca Forms and several other companies as part of a coordinated campaign. The compromised servers were used to deliver malicious JavaScript to thousands of websites, enabling the scripts to harvest data entered into any form field, including payment details, login credentials, and contact information. The stolen information was then exfiltrated to a server located in Panama. The attack followed a supply‑chain model, exploiting the widespread distribution of code through third‑party service providers to maximize impact. Cloud CMS intervened to shut down the malicious script delivery network, limiting the duration of the exposure. Some affected providers, such as Picreel and OmniKick, experienced non‑functional malicious code due to implementation errors, which reduced the amount of data that could be stolen from their sites. The incident underscored a growing trend in which threat actors target secondary vendors to bypass direct defenses of high‑profile targets. No additional details about Alpaca Forms’ internal structure, ownership, or subsequent remediation efforts are provided in the source material.