The code has been injected into the sites by cyberthieves, said Dutch developer Willem De Groot.
He found the 5,925 compromised sites by scanning for the specific signature of the data-stealing code in website software.
Some of the stolen data was sent to servers based in Russia, he said.
Costly mistake
