# Hacked PrestaShop: the checkout first, then everything else.

> PrestaShop hacked, or are your customers' cards being stolen? I clean the store, remove the checkout skimmer and guide you on the GDPR. From €349.

URL: https://webintacta.com/en/hacked-prestashop-repair
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-28

**In short:** If your PrestaShop store has been hacked, check the checkout first, because a skimmer can be copying card details while the store keeps selling as usual. At WebIntacta I (Jose Soriano, a PrestaShop developer) clean the store, remove the skimmer, check overrides and modified modules, close the module or password they got in through and give you the technical report a breach notification needs. It costs €349 ($349 outside the EU), excluding VAT, with a 90-day guarantee, for PrestaShop 1.6 to 9, in English by email and chat.


In an online store, the attack that does the most damage is the one you can't see: a script in the checkout that copies your customers' cards while the store keeps selling as usual. I work with PrestaShop every day and I know where it hides.

## What usually turns up in a PrestaShop store

- Customers disputing charges they didn't make after buying from your store
- A payment step with a card form you didn't put there
- Files in `override/` or in `classes/` (for example `Cart.php`) that differ from the original
- Modules you didn't install, or versions with published vulnerabilities
- JavaScript injected into the configuration, `.tpl` templates or CMS pages
- Admin or cache folders with recent .php files

## How I do it

1. **Stop the leak.** If there is a skimmer, the first thing is to pull it out of the checkout, even if that means taking a payment method offline for a while. Every hour it stays active means more stolen cards.
2. **Core and module integrity.** I compare every file with the original for your PrestaShop version and go through overrides, modules and templates. Whatever was modified gets replaced or fixed.
3. **Way in and access.** I find the vulnerable module or the leaked credential, update or replace it, change the keys in `parameters.php` and review the back-office employees.
4. **Customers, bank and GDPR.** If data was stolen, I explain what usually has to be notified (under the GDPR or the UK GDPR, your data protection authority within 72 hours; elsewhere, your local breach rules) and what to tell your payment provider. The decision and the notification are yours; I give you the technical report they need.

## Hacked PrestaShop store: skimmer, malware and the way in

## Credit card skimmer on PrestaShop: what to check first

1. **Make a test purchase without being logged in**, in a private window and on a phone. A card form you did not add, an error before the real payment page or an extra step are the classic signs of a fake payment form.
2. **Open the theme's shared header**, `themes/your-theme/templates/_partials/head.tpl`, and the checkout templates. According to Sansec, PrestaShop warned merchants in January 2026 to check their theme template files for injected skimmers, and Sansec recommends starting with this file.
3. **Search the database for script tags**: a `<script>` stored in the configuration table, or in an HTML block or custom code module, can run a skimmer that never appears in the files.
4. **Compare the core and the payment modules** with the originals for your exact version, and list the files in `override/`.
5. **If you find something, don't delete it yet**: disable the payment method or put the store in maintenance mode, take a copy and write to me. The copy shows how they got in and since when.

Each check, with what the code usually looks like and why it hides from logged-in admins, is in [credit card skimmer on your website: how to detect it](https://webintacta.com/en/guides/credit-card-skimming-online-store).

## Not only PrestaShop

What I describe here applies to any hacked online store, not just PrestaShop: in WooCommerce the skimmer hides in a plugin or in the database, and in PrestaShop it usually lives in an override, a modified payment module or the theme settings.

How card theft at checkout works, how to detect it and what to do about affected customers is in the [guide to credit card skimming in online stores](https://webintacta.com/en/guides/credit-card-skimming-online-store). If personal data was affected, the GDPR side is in [data breach in an online store](https://webintacta.com/en/guides/online-store-data-breach-gdpr).

If you want to know what to do in the first hour, before hiring anyone, read [PrestaShop hacked: what to do](https://webintacta.com/en/guides/prestashop-hacked-what-to-do). And if the source is a module with a published flaw, in [vulnerable PrestaShop modules](https://webintacta.com/en/guides/vulnerable-prestashop-modules) I explain how to check yours.

## Price

Stores cost more than a business website: there are payment modules, overrides, a bigger database and customer data.

### PrestaShop or WooCommerce cleanup — €349 (excluding VAT)
Stores: on top of the malware, checkout, overrides and customer data.

$349 outside the EU.
- Everything in the WordPress cleanup
- Checkout: skimmers and fake payment forms
- Modified overrides, modules and templates (PrestaShop)
- Guidance on breach notification (GDPR) if data was affected

> 90-day guarantee: if it gets reinfected, I clean it again at no cost.

**With priority: +€100** (+$100 outside the EU). Your case goes ahead of every other job, weekends too if needed. It is priority, not a guaranteed deadline.

### Store rescue — €649 (excluding VAT)
Store cleanup with priority + 3 months of Online store maintenance with the Priority add-on.

$589 outside the EU.
- PrestaShop or WooCommerce cleanup with priority
- 3 months of Online store maintenance
- 3 months of the Priority add-on

> Afterwards it moves to the plan's normal fee; you can cancel it.

Outside the EU, the same remote cleanup for a hacked PrestaShop store costs $349.

## Frequently asked questions

### How much does it cost to clean a hacked PrestaShop store?

€349 for the store cleanup, and +€100 if you want it with priority, excluding VAT, with a 90-day guarantee. The Store rescue pack (€649) adds three months of Online store maintenance with the Priority add-on.

### How do I know if card details are being stolen?

The most reliable sign is your bank or payment provider warning you about fraud on purchases made in your store. Technically, you see a payment form or a script that doesn't belong to the official payment module. The [free scan](https://webintacta.com/en/free-website-security-scan) checks the visible scripts; the [inside report](https://webintacta.com/en/website-security-audit) checks files and the database.

### Do I have to close the store?

Not always. If there is an active skimmer, sometimes it is enough to disable the affected payment method while it is being cleaned. We decide based on what I find in the diagnosis.

### Do you work with PrestaShop 1.6, 1.7, 8 and 9?

Yes. On 1.6 the cleanup is possible, but that version no longer gets patches: I will suggest how to upgrade so it doesn't happen again.

### What about the GDPR?

If personal data was affected and your store is subject to the GDPR or the UK GDPR, the controller (you) must notify the data protection authority within 72 hours of becoming aware of it, and the people affected if the risk is high. Outside Europe, local breach laws apply (in the US, state by state). I give you the technical report with which data and since when; for the legal side, check with your adviser.

### My store is not in Spain. Can you still help, in English?

Yes. I work remotely with stores in any country, in English by email and chat (no phone calls), so everything stays in writing. Customers outside the EU pay $349; EU businesses with a VAT number are invoiced from Spain under the reverse-charge rule.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en