State-sponsored North Korean hackers targeted retail websites and inserted malicious code meant to steal credit card details, according to a recent report from cybersecurity firm SanSec.

In its report released on July 6, SanSec claimed that the DPRK-sponsored Lazarus Group was behind a credit card skimming, or “Magecart,” scheme that goes as far back as May 2019 and focuses on American and European consumers.

The compromised sites ranged from American mall fixtures Paper Source and Claire’s to a family-owned New Jersey bookshop and a Brooklyn camera store.

Magecart refers to both the assorted criminal groups who perform these attacks as