Attackers steal credit card information of 40,000 OnePlus customers
Following a hack that compromised credit card details of 40,000 customers, OnePlus has disabled credit card purchases on oneplus.net last week. The step by the Shenzhen, China-based smartphone maker followed customer’s reports that they did not recognise card transactions after making purchases on the site.
OnePlus confirmed the reports that 40,000 customers were affected by a compromise of its website that allowed attackers to steal credit card details as they were being entered into browsers. The hackers used a malicious script that was injected into oneplus.net’s payment page which recorded card details as they were entered into the browser. The company said card details are not processed or stored on its site and are sent over an encrypted connection directly to a third-party payment services provider.
However, the company said that the hackers injected code into oneplus.net that recorded card information. It said in a statement that one of its systems was attacked, and a malicious script was injected into the payment page code to sniff out credit card info while it was being entered. The script operated between mid-November 2017 and 11 January 2018 and affected those who entered card details for the first time, but those who used saved card information or third-party methods such as PayPal weren’t affected.
OnePlus said it has isolated the system involved and is working with its payment provider on a more secure system. A company spokesperson said the 40,000 users “represent a small subset” of the company’s total customer base. It said that it is offering customers a year of free credit monitoring and is working with law enforcement authorities to investigate the hack. OnePlus said that it has notified all those potentially affected via email, urging them to be on the lookout for suspicious card transactions. The company said that it cannot apologize enough for letting something like this happen.
OnePlus offers handsets and accessories to all its markets and also sells in the UK through carriers such as O2. Its latest Android-based OnePlus 5T has been launched in the UK on November 21 at £449 or £499 versions, significantly undercutting the £999 iPhone X.