OnePlus warns customers about stolen credit card data

[Wauthar]

OnePlus has come out saying that over 40,000 customers might have had their credit card data stolen by a malicious script on their servers. The customers affected have been informed by email last Friday.

Quote

1. What happened

One of our systems was attacked, and a malicious script was injected into the payment page code to sniff out credit card info while it was being entered.

• The malicious script operated intermittently, capturing and sending data directly from the user's browser. It has since been eliminated.
• We have quarantined the infected server and reinforced all relevant system structures.

2. Who's affected

 

• Some users who entered their credit card info on oneplus.net between mid-November 2017 and January 11, 2018, may be affected.
  • Credit card info (card numbers, expiry dates and security codes) entered at oneplus.net during this period may be compromised.
  • Users who paid via a saved credit card should NOT be affected.
  • Users who paid via the "Credit Card via PayPal" method should NOT be affected.
  • Users who paid via PayPal should NOT be affected.
• We have contacted potentially affected users via email.

 

OnePlus is investigating the theft and is offering one year of credit monitoring for those affected. Users are urged to keep a close eye on their banking records.

 

Sources:

OnePlus blog: https://forums.oneplus.net/threads/jan-19-update-an-update-on-credit-card-security.752415/

Tweakers.net (dutch source): https://tweakers.net/nieuws/134213/oneplus-creditcardgegevens-40000-klanten-zijn-gestolen-via-betaalpagina.html

 

So, FYI for the people here who ordered anything from the OP store between these dates.

It makes me wonder how exactly the script ended up on the OP server and how secure we might think our data actually is...

[Oshino Shinobu]

OnePlus really isn't having a good time recently. It seems like there's something new that they've messed up every week. 

[AlTech]

Well shit. I might be among the potentially affected.

[ItsMitch]

HAHAHAHAJjJajdaAs fucking called it

[Wauthar]

3 minutes ago, AluminiumTech said:

Well shit. I might be among the potentially affected.

Have you gotten an email from them? They're still investigating the issue, but almost everyone affected has been contacted, they said.

Keep an eye out on your stuff!

[AlTech]

4 minutes ago, Wauthar said:

Have you gotten an email from them? They're still investigating the issue, but almost everyone affected has been contacted, they said.

Keep an eye out on your stuff!

I haven't been emailed (yet) but I definitely purchased stuff from them within that time period.

[D13H4RD]

Never Settle for secure payments 

[Silentprototipe]

[ItsMitch]

What really worries me if what if that company didn't do a check on the one plus payment method security, and the fact they have the balls to say "it's only a small amount of customers that are effected" is ridiculous

[Wauthar]

2 minutes ago, SC2Mitch said:

What really worries me if what if that company didn't do a check on the one plus payment method security, and the fact they have the balls to say "it's only a small amount of customers that are effected" is ridiculous

Yeah, I have no idea how many transactions have been made in that period of time, but saying 40k is a small amount/portion does sound weird.

[Bananasplit_00]

yah i am firmly staying away from OnePlus for the forseable future. not touching them again after all this security and data shit

[vorticalbox]

3 hours ago, Wauthar said:

Yeah, I have no idea how many transactions have been made in that period of time, but saying 40k is a small amount/portion does sound weird.

That would depend on the amount of total transaction. For a site like Amazon where they have millions of payments daily 40k is a drop in the pound. Though I have my doubts that one plus would have anywhere near that volume. 

[Nena Trinity]

If I was a 1+ customer, I would stop being their customer after this.

[PopReference]

I was thinking of buying a 5t, guess I just missed a bullet.

[themctipers]

i thought everyone started to avoid 1+ after the first incident of spying ..

or at least the second one ..

[Wauthar]

49 minutes ago, themctipers said:

i thought everyone started to avoid 1+ after the first incident of spying ..

or at least the second one ..

I am curious how it will turn out for OnePlus in the long run. I'm still very happy with my OPO, but I don't deal with the company itself. 

[Canada EH]

Perfect reason to have a separate credit card for these types of purchases.

Prepaid with no monthly fee's

Load it up only when you will be buying something same day!

[Kamina]

Bad year for tech.

 

We're in the digital apocalypse. 

[imreloadin]

At least the advised people of it quickly once they discovered it.

 

If this were something important like a certain major US credit agency they wouldn't have told anyone for a year