OnePlus Confirms up to 40,000 Users Affected by Data Breach

Chinese smartphone manufacturer OnePlus confirmed that its online payment system was compromised in a credit card breach. This follows complaints of fraudulent credit card transactions reported by customers who made purchases on the company’s official website, oneplus.net. The data breach compromised the information of 40,000 users who entered their data on the website between mid-November 2017 and January 11, 2018.

During an investigation, OnePlus found a malicious script in the code of the site’s payment page that stole entered information. However, it is not yet clear how hackers broke into the site. Breached information included full credit card information, card numbers, expiry dates, and security codes. OnePlus has since removed the script, quarantined the infected server , and reinforced relevant system infrastructure.

The breach did not affect users who paid using PayPal and through a “Credit Card via PayPal” option. For now, OnePlus has temporarily disabled its credit card payments, but transactions made through PayPal are still accepted. Meanwhile, OnePlus has contacted potentially affected users via email and advised users to report fraudulent charges in card statements to their banks.

Data breaches such as the OnePlus incident places private records and other sensitive data at risk of being stolen. It affects not just the organization, but also those whose personal information may have been stolen. Cybercriminals can do this by physically accessing a computer network to steal local files, or by bypassing network security remotely.

The OnePlus data breach is similar to an attack on Target in January 2014, wherein hackers got into the retailer's network and infected all of their Point-of-Sales machines. The stolen information included PIN numbers, names, and banking information, consequently exposing 40 million debit and credit cards to fraud. For instance, credit card information can be valuable to cybercriminals as this information can be used to make a profit from duplicated credit cards and using personal information for fraud, identity theft, and even blackmail. Stolen personal and financial information can also be sold in bulk in deep web marketplaces.

Here are some things you can do if you fear your information was part of a data breach:

• Notify your bank. Verify account details and change PIN codes and account passwords.
• Double check email addresses from incoming emails. Cybercriminals can pose as bank representatives and ask for credentials.
• Avoid clicking any suspicious links or download files from unknown sources.
• If your credentials or financials have been tampered with, contact the breached company and ask if they offer credit monitoring or identity theft protection services for affected customers.