How to Harden Your Magento 2 Database Against Unauthorized Access

Your Adobe Commerce Store Has a Hole That SSL Cannot Patch. You locked the front door. You installed the alarm. You hired the guards.

And the thief walked in through the floor.

That is exactly what happens when an eCommerce store runs Adobe Commerce or Magento 2 with customer data sitting in plain text inside the database. SSL protects data in transit. WAFs block attacks at the perimeter. But the moment a bad actor bypasses the application layer and lands directly inside your database, every name, every email, every order, every address is right there. Readable. Exportable. Sellable.

We spent weeks searching the Adobe Commerce ecosystem for a field-level PII encryption solution that could fix this. We found nothing. So we built one. We called it PII Shield.

The Problem No One Talks About Out Loud

Adobe Commerce already does several things right. Payment credentials are encrypted. System configurations are protected. Passwords are hashed using SHA-256. But actual customer PII, the names, phone numbers, street addresses, email IDs, and order histories that make your database a goldmine, those are stored as plain text.

This matters more than most merchants realize. According to IBM's 2025 Cost of a Data Breach Report, more than half of all data breaches globally involve customer PII, including tax identification numbers, emails, phone numbers, and home addresses. On top of that, each compromised customer PII record cost organizations USD 160 to contain in 2025.

And the threats to Magento specifically have been escalating. The CosmicSting vulnerability (CVE-2024-34102) in 2024 was described by security researchers at Sansec as the worst Magento bug in two years, and it was estimated to have left 75% of all Adobe Commerce stores exposed. Then came SessionReaper (CVE-2025-54236) in 2025, rated 9.1 out of 10 in severity, allowing attackers to take over customer accounts through the Commerce REST API. These are not fringe scenarios. These are documented, widespread, and recurring patterns of attack.

Here is the part people do not want to say openly: the threat is not always external. An employee with database access can export a customer list in one Excel sheet and sell it. It happens. No one admits to it. But it happens, and it is precisely why people sometimes receive scam calls from numbers they never shared with anyone.

What PII Shield Actually Does

PII Shield is a field-level encryption extension for Adobe Commerce and Magento 2, built at Codilar. It encrypts sensitive personal data at the database level, automatically, the moment it is written. When authorized users, whether a logged-in customer or an admin, access that data through the website or backend, it decrypts in real time. The experience for users is completely unchanged. What changes is what a hacker sees if they ever manage to reach the database directly.

They see gibberish.

Not obfuscated data. Not partially masked strings. Encrypted noise that cannot be decoded without the application-level decryption keys, which live inside the system, never in the database itself.

The encryption algorithm powering this is Libsodium, which happens to be the same modern cryptographic library that Adobe Commerce trusts internally for its own encryption operations. We did not invent a proprietary algorithm. We used the gold standard and applied it to the fields that Adobe left exposed.

What Gets Encrypted

PII Shield does not encrypt everything indiscriminately. Operational metadata like store IDs, timestamps, group assignments, and system-level data remain untouched because encrypting them would create unnecessary overhead with no privacy benefit. What gets encrypted are the fields that actually identify a person and their behavior in your store.

Across nine data areas in Adobe Commerce:

Customers: First name, last name, email address, phone number, date of birth, and other identity fields stored in the customer table.

Carts (Quote table): Customer-linked information stored when items are added to cart, including billing and shipping details entered at checkout.

Orders: Full order records including the customer's name, contact details, and delivery address.

Invoices: Invoice-level records tied to customer identity and order specifics.

Shipments: Shipping address, recipient name, and tracking-related PII.

Credit Memos: Refund records tied to customer identity.

Newsletter Subscriptions: Email addresses collected through newsletter sign-up flows.

Admin Users: Backend user accounts, because your internal team's data deserves the same protection as your customers' data. In agencies or large organizations with multiple admin roles, catalog managers, marketing specialists, and sales teams all have profiles in the system. Those are encrypted too.

Payment-related records: Payment card and billing information stored at the database level.

Everything else stays normal. Performance is unaffected. Search, checkout, order management, and every customer-facing workflow continues without disruption.

Why Perimeter Security Is Not Enough

The security stack most eCommerce stores rely on, SSL certificates, firewalls, WAFs, and fraud prevention tools, is designed to protect the perimeter. They assume that if attackers cannot get in, the data is safe.

That assumption breaks the moment the perimeter is breached.

The pattern of database-level breaches has not slowed. In 2025, retail security incidents rose to 837 confirmed cases, up from 725 the prior year, with nearly half of all breaches involving customer PII including names, email addresses, payment details, and purchase histories. The Ticketmaster breach, where over 560 million customer records including order history, payment information, names, and email addresses were leaked after attackers accessed a cloud database, remains one of the clearest examples of what direct database access means in practice. And the National Public Data breach exposed 2.9 billion records because plain-text credentials were sitting in a publicly accessible file, not through a sophisticated attack, but through data that was simply left readable.

Field-level encryption is the answer to this. It ensures that even a successful breach of your infrastructure does not result in a usable data leak. The attacker reaches the database and finds nothing readable.

This is the principle behind Codilar's PII Shield: protecting the data itself, not just the routes to the data.

Compliance and Commercial Reality

GDPR penalties since 2018 now exceed 7.1 billion euros, with 1.2 billion euros in fines issued in 2025 alone. European data protection authorities now receive 443 breach notifications per day, a 22 percent year-over-year increase. The largest single fine of 2025 was 530 million euros against TikTok for unlawful EU-China data transfers. India's DPDP Rules were approved by Parliament in November 2025 and are now entering enforcement, which directly affects merchants operating in or serving Indian consumers.

Field-level encryption is increasingly recognized as the expected standard for PII protection in eCommerce. If your customer data is stored in plain text today and you face a breach tomorrow, regulators will ask what preventive measures were in place at the database level. SSL and a firewall will not be a satisfying answer.

On the commercial side, the average data breach cost for retail and eCommerce businesses reached USD 4.1 million in 2025, with 32 percent of breaches tied to payment data. And 75 percent of consumers say they will not purchase from organizations they do not trust with their data.

If you want to understand what your current database exposure looks like, or if you want to explore deploying PII Shield on your Adobe Commerce store, talk to our team.

❝

If you want to understand what your current database exposure looks like, or if you want to explore deploying PII Shield on your Adobe Commerce store, talk to our team. "Adobe Commerce is one of the most capable platforms in the world. But capability without database-level encryption is like a vault with the door open. PII Shield exists because we refused to leave that door open for our clients." - Shahed Jamal, Practice head, Adobe Commerce, Codilar❞

Shahed Jamal | Practice head - Adobe Commerce, Codilar

13+ Years of Experience