Magento / Adobe Commerce site compromised?
Take back control in 48 hours.
On Magento, the primary risk is payment card skimming at checkout. Every hour counts, for your customers and for your notification obligations.
What we see on Magento / Adobe Commerce
The Magento price is public and fixed: €1,490 excl. VAT if your store is not compromised, €2,990 excl. VAT if it already is.
Why Magento needs separate treatment
Open Source and Adobe Commerce are not supported the same way. Extended support is reserved for Adobe Commerce customers; it does not exist for Magento Open Source. An Open Source store therefore falls out of support far earlier than its operator believes, and no further patches are published for it.
It is the platform most targeted by card data theft. Code injected into the checkout is often conditional: it fires only on the payment page, for a real basket, and stays invisible to a surface scan. A store can look clean and be stealing cards for months.
Hosts exclude Magento from their cleanup offers. Major managed hosts explicitly restrict their malware removal to WordPress and WooCommerce and refer Magento merchants to third parties. In practice, you have no one to call at your host.
The technical scope is wider. Core, modules, theme, but also message queues, cron jobs, API integration tokens, admin accounts, and the database holding your orders and customer data. A partial eradication lets the attacker back in.
Four phases, monitoring included
Triage
Confirmed compromise or false positive? Scope, exposed data, legal obligations. Engagement authorisation signed online, secure access established.
Analyse
Checkout flow and third-party script analysis, core and module integrity, logs, database, admin accounts and API tokens.
Eradicate
Skimmer removal, credential and token rotation, strict content security policy, admin hardening, support with regulatory notifications where required.
Monitor
Integrity probes and automated watch for 30 days, with an alert channel validated by a real end-to-end test.
Magento / Adobe Commerce engagement
Published rates, signed scope, best-efforts obligation stated in writing.
Emergency response
- Triage and full forensic analysis
- Root-cause eradication and credential rotation
- Third-party access audit (keys, vendor accounts)
- 90 days of monitoring and re-cleaning guarantee
- Executive summary report
- Optional insurer / ad-platform report: + €400 excl. VAT
What is included, what is not →
Start an interventionFrequently asked questions
How fast do you respond?
First response from an engineer within 5 hours, Monday to Friday, 8am to 8pm. “Response” means talking to an engineer, not an automated acknowledgement.
Should we take the site offline immediately?
Not before speaking with us. Shutting down destroys volatile evidence and does not remove persistence. We move the site into controlled maintenance instead.
What if no compromise is confirmed?
You keep the diagnostic report and nothing else is billed. If you prefer, the amount paid becomes a credit towards preventive hardening.
Do you guarantee we will not be attacked again?
No — and be wary of anyone who promises that. We are bound by a best-efforts obligation stated in the contract: industry standards, a defined scope, and 30 days of monitoring to verify the eradication holds.
Our ad account is suspended — can you help?
Yes, as an option: we assemble remediation evidence in the expected format, file the review request and follow it through to removal of the flag — the same process applies to cyber insurance claims.
Two infections nobody had found
In June 2026, a French furniture store running PrestaShop is hacked. The insurer appoints a specialist provider, who deploys a detection tool on the server. For seven weeks, the infections keep coming back. In mid-July, Google detects the compromise and suspends the ads: 17 days without advertising, at the peak of the season.
The team that went on to found Cerbexia takes over the investigation. Within four days, it finds two injections nobody had detected: a script hidden in the theme template, loaded on the cart page, and a second piece of code buried in a configuration file, present since the first day of the attack, which redirected Android visitors to a fake app store. It then identifies the entry point and closes it.
Result: the site cleaned end to end, Google restrictions lifted, and file integrity monitoring in place ever since. This is the method we apply on every engagement.
Cleaning is not enough. We stay by your side.
30 days of monitoring
After every engagement, your site stays under integrity monitoring. Any suspicious change triggers an alert and a call.
A written good-practice plan
For you and your team: access, updates, backups, modules, providers. What to do, in which order, in plain language.
An engineer you can reach
The same contact, by phone, for your questions in the weeks that follow. No ticket, no queue.
Contact us
An engineer replies within 4 to 5 hours — within 4 hours for continuous-protection subscribers.
[email protected]
Remote engagements across Europe — EN / FR / ES / IT / PT / PL / HU / CS