Customer

Have I Been Pwned

Learn how Have I Been Pwned uses Report URI to monitor their site for Malicious JavaScript and unauthorised Data Exfiltration!

XSS

Instructure Canvas Breach

A support ticket containing a linked file reached 275 million student records — and four days passed before anyone noticed the stolen session.

Uses CSP

Google

Gmail, YouTube, Cloud Console and Google Drive all enforce a Content Security Policy, with Trusted Types on top. Read off their live response headers.

Supply Chain

Bybit Supply Chain Attack

$1.46 billion — the largest theft in the asset class's history — began with a modified JavaScript file, served to a single wallet and removed two minutes later.

Cryptojacking Supply Chain

US Courts Cryptojacking Attack

The United States Courts were infected with Cryptojacking Malware that used visitor's browsers to mine Cryptocurrency for the attackers.

Magecart

Newegg Magecart Attack

Eight lines of JavaScript skimmed Newegg’s checkout for 35 days in 2018 — the same group as British Airways, with the code cut to a third of the size.

Customer

Paddle

Paddle are a Payment Infrastructure Provider and use Report URI to help meet their obligations under the new PCI DSS 4.0!

Magecart

Ticketmaster Magecart Attack

Ticketmaster were targeted by Magecart in an attack via a 3rd-party dependency. Learn how Report URI could have helped and saved millions in damages.

XSS

Operation RoundPress

A spearphishing email injected JavaScript into the victim’s open webmail page. Nothing touched disk for endpoint tooling to find.

Supply Chain

Polyfill.io Supply Chain Attack

A dependency 100,000 sites trusted changed hands and started serving malicious code. Nothing on any of those sites changed.

Uses CSP

GitHub

GitHub's entire script-src is a single hostname. They shipped their first policy in 2013 with a wildcard in it and spent three years tightening it in public.

Magecart

European Space Agency Magecart Attack

The ESA was infected with Magecart which resulted in the organisation having to take down certain infrastructure.

Uses CSP

Dropbox

Four posts in 2015 on getting a policy into production, including the report noise that nearly stopped them. The policy is still in their headers today.

XSS

Ivanti EPM Device Name XSS

An unauthenticated request wrote JavaScript into a device name, to fire later in an admin dashboard with authority over every managed endpoint.

Magecart

CosmicSting Magento Attacks

CVE-2024-34102 was used to skim 4,275 Adobe Commerce and Magento stores. Applying the patch did not stop it, because the stolen keys stayed valid.

Magecart Supply Chain

Volusion Supply Chain Attack

One modified platform library reached 6,589 merchant stores. None of them were breached, and 239,000 cards were later sold.

Customer

Shoptet

Shoptet is an e-commerce platform used by more than 40,000 active online stores across the Czech Republic, Slovakia, and Hungary.

Cryptojacking Supply Chain

ICO Cryptojacking Attack

The Information Commissioner's Office was the victim of a Cryptojacking Attack that could have been detected and even stopped using Report URI.

XSS

Zimbra Token Theft

Exploited as a zero-day for six weeks, then again after the patch made it public. The payload stole the authentication token, not the mail.

Uses CSP

GOV.UK

They ran CSP in report-only for years before enforcing it in Summer 2023, and published the decision, the manual and the policy source along the way.

Customer

REPAY

REPAY Holdings Corporation is a leading payments technology company that delivers secure, frictionless payment solutions across multiple industries.

Magecart

Claire’s Magecart Attack

A day after Claire’s closed 3,000 stores for lockdown, attackers registered their exfiltration domain. The skimmer ran for six to seven weeks, disguised as an image request.

Uses CSP

Twitter and X

In 2013 Twitter published why their own front page had too much inline JavaScript for CSP. Today x.com forbids inline event handlers outright.

Magecart

British Airways Magecart Attack

Magecart targeted British Airways to gain access to significant quantities of PII and PCD, resulting in 8-figure fines for the organisation.

Uses CSP

login.gov

The US federal login page runs the cleanest policy in this research — no unsafe-inline, no unsafe-eval — and you can read its source in public.

Case Studies