Skip to main content

Up to 40,000 customers’ info may have been stolen from OnePlus

OnePlus finds that security flaw may have jeopardized 40,000 customers' info

oneplus 5t review screen protector
Andy Boxall/Digital Trends
Smartphone maker OnePlus has released initial results of an investigation into its web store’s payment methods after some of its customers claimed they had been hit by credit card fraud shortly after making a purchase from OnePlus.

The issue arose when a user by the name of Superdutynick noticed that both of his credit cards had been used for fraudulent charges after he made two separate transactions on the OnePlus store. Noting that the only common denominator was the OnePlus store, he started a poll on the official OnePlus forums asking whether other users had experienced a similar problem. When a significant percentage replied that they had, and it was quickly followed by a similar post on Reddit that attracted hundreds of concerned comments, it became obvious that OnePlus was going to have to address the issue.

The company did, in fact, react quickly. It responded with a forum post of its own explaining the situation, and later disabled all credit card payments on the website while the investigation was taking place. OnePlus team member Mingyu seems fairly certain what isn’t the cause of the leaks, saying that the recent Magento hack is not to blame, since the OnePlus website has been rebuilt since 2014, and had never included the Magento payment module on the previous Magento ecommerce site. Mingyu also did not believe it was as a result of a breach of OnePlus’s security, since no card details are stored on their servers.

Information security website Fidus seems to disagree with that idea, noting that OnePlus itself is not PCI-DSS compliant, and that while no information is stored on the OnePlus website, there is a single page still hosted on OnePlus’ infrastructure where card details could be stolen, if an intruder has access.

Fidus seems to have been right on the money, as OnePlus has come back with the initial results of its investigation, and has warned that up to 40,000 customers may have been affected by a security flaw between mid-November 2017 and January 11 2018. That flaw allowed for a malicious script to pick up customers’ credit card details as they were entered onto the site.

OnePlus has reached out to as many of the affected customers as it can, but is urging all of its customers to be vigilant for any unauthorized activity on their credit cards. It’s important to note at this stage that only customers who were inputting their payment details into the site for the first time were susceptible to being attacked by the script, and anyone using a saved payment method is safe from the breach. The latter also applies to anyone who paid via PayPal, either by the usual PayPal payment method, or a credit card via PayPal. However, it’s always worth checking your credit card receipts, just in case.

OnePlus has apologized unreservedly, and has stated that it is working with its credit card authorization company to ensure that this hole is plugged as quickly as possible. It added that it will be working hard to stop anything like this happening again.

OnePlus has been one of Android’s major success stories, with the company coming out of nowhere to become an established name within smartphones. It recently released its OnePlus 5T to great acclaim, and while no stranger to controversy, has generally had good press on its side.

OnePlus is urging anyone who has previously made a purchase on its webstore using a credit card to check their statements and get any unauthorized charges reversed wherever possible.

Update: Updated with the results of the investigation by OnePlus.

Editors' Recommendations

Mark Jansen
Mark Jansen is an avid follower of everything that beeps, bloops, or makes pretty lights. He has a degree in Ancient &…
OnePlus customer data stolen in second data breach in two years
oneplus 7t macro lens iphone 11 lacks cameras

Phone company OnePlus has suffered another data breach, with an undisclosed number of customer names, contact numbers, email addresses, and shipping addresses stolen by an unnamed hacker or group.

This comes less than two years after up to 40,000 customers' private information was stolen from OnePlus, leading to credit card fraud using customers' details. In this case, the breach only came to light when the issue of credit card fraud was raised by a user on the OnePlus forums. An investigation subsequently discovered a malicious script had been gobbling up customer credit card details when they were entered into the OnePlus website.

Read more
The next OnePlus phone may have four rear camera sensors, hole-punch display
oneplus 8 pro leak

It’s barely been a month since OnePlus introduced the OnePlus 7T but leaks and rumors about the company’s next phones have already begun to pour in. The latest one by a source called TrueTech reveals a series of diagrams of OnePlus’ rumored OnePlus 8 Pro smartphone.

The leak suggests OnePlus is yet again tweaking its flagship’s screen design and is letting go of the pop-up front camera in favor of a hole-punch display featuring circular cutouts for the selfie sensor. The report further claims the Chinese phone maker is experimenting with asingle as well as dual front-facing camera setups.

Read more
Party crasher: OnePlus may send out Android 10 update at the same time as Google
OnePlus 7 Pro 5G

OnePlus may be the only kind of party crasher we want. A text chat with a OnePlus representative shared on Reddit indicates the company is working hard to send out an update to Android 10 on the same day as Google itself launches the new version. This would mean the software arrives on the OnePlus 7 Pro and other compatible OnePlus phones the same day as the Google Pixel range.

The Reddit member apparently chatted with OnePlus support online, and during the conversation, the OnePlus team member stated, “We wish to provide an update simultaneously with the Android 10 launch,” and reconfirmed the intention when asked for clarification. The team member also said the release date for the final version of Android 10 is September 3.

Read more