Android phone maker OnePlus was forced to shut down credit card payments on its website last week after numerous reports from customers of fraudulent charges. Today, the company has announced the preliminary results of its investigation, showing that as many as 40,000 customers may have had their credit card details stolen. It turns out a malicious script has been hiding on its website for about two months.
According to OnePlus, an unknown attacker accessed one of its servers in mid-November and implanted a script, which siphoned payment details from customers when they entered their payment information in OnePlus’ online store. The stolen data included the card number, security code, and billing information. That’s everything you need to use the card. The code ran intermittently over the coming weeks until credit card payments were shut off on January 11th, 2018.
This was a well-timed attach, too. OnePlus released its newest phone, the OnePlus 5T, in November 2017. The phone started at $499 and packs much of the same hardware you get in more expensive phones like the Galaxy S8 and Pixel 2 XL. The malicious code was running on its servers during the initial rush of orders all the way through the holiday shopping season. Anyone who used a credit card on OP’s site during this time should assume their card is compromised. Those who used PayPal to buy their phone should be safe, though.
OnePlus says it has quarantined the affected server as the investigation continues. It’s not yet clear if the attacker was able to load the malicious script remotely or if they had physical access to the hardware. The company will provide more details when it has them, but customers whose details are known to be stolen are being contacted via email. Credit card payments on OP’s site continue to be disabled, but you can buy phones and accessories via PayPal.
Even if OP does not send an email, you should assume a card used on the site between November and the shutdown last week has been stolen. Just because there are no fraudulent charges yet doesn’t mean you’re in the clear. Your details could be sitting in a database that will be sold off in the coming weeks. OnePlus recommends those affected keep an eye on their statements, but that’s not really enough. If you used a card on OP’s site during the time it was compromised, it’s probably time to cancel the card.
ET Deals Roundup: $200 Gift Card with Samsung 4K TV for $600, $50 Price Drop on Inspiron 15 7000, and more
Ready to upgrade to a 4K television? Maybe you're looking for a new laptop for school, or searching for the perfect camera for an upcoming vacation. Well, there are plenty of discounts floating around this week, so we've put together a list of the hottest deals. If you're looking to save big on new gear, you're bound to find something worthwhile below.
Top-Secret ‘Zuma’ Satellite Launched by SpaceX May Have Been Lost
The recent "Zuma" launch appeared to go off without a hitch, but now there's reason to think the US spy satellite might have been destroyed before going into operation.
SanDisk Shows Off 1TB Flash Drive Prototype
The new USB Type-C stick includes a whopping 1TB of storage.
Samsung to Announce Galaxy S9 at Mobile World Congress in February
Previous rumors pointed to a surprise Galaxy S9 unveiling at CES, which is underway now. However, Samsung is on hand not with the hotly anticipated new Galaxy phone, but with TV, smart home devices, and appliances — lots and lots of appliances.