91APP data breach affects nearly 4.8 million consumers

Taiwanese e-commerce cloud service provider 91APP has confirmed a significant data breach affecting approximately 4.8 million consumers across 1,329 brands. The breach occurred when hackers utilized an automated attack tool to exploit a vulnerability in an unpatched internal third-party tool, allowing unauthorized access to an order database.

Major brands including FamilyMart, MUJI, and Konny have confirmed that some of their order data was stored in the compromised database. The leaked information potentially includes names, phone numbers, delivery addresses, email addresses, and purchase histories. However, 91APP stated that sensitive data such as passwords and credit card information were not part of the affected database.

91APP Chairman Ho Ying-chi has issued a public apology and committed to a compensation scheme for affected consumers, regardless of whether direct financial loss is proven. The application period for compensation is set to run until February 1, 2027. To prevent future incidents, the company plans to implement a zero-trust architecture and AI-driven anomaly detection.