The issue arose when a user by the name of Superdutynick noticed that both of his credit cards had been used for fraudulent charges after he made two separate transactions on the OnePlus store. Noting that the only common denominator was the OnePlus store, he started a poll on the official OnePlus forums asking whether other users had experienced a similar problem. When a significant percentage replied that they had, and it was quickly followed by a similar post on Reddit that attracted hundreds of concerned comments, it became obvious that OnePlus was going to have to address the issue.
The company did, in fact, react quickly. It responded with a forum post of its own explaining the situation, and later disabled all credit card payments on the website while the investigation was taking place. OnePlus team member Mingyu seems fairly certain what isn’t the cause of the leaks, saying that the recent Magento hack is not to blame, since the OnePlus website has been rebuilt since 2014, and had never included the Magento payment module on the previous Magento ecommerce site. Mingyu also did not believe it was as a result of a breach of OnePlus’s security, since no card details are stored on their servers.
Information security website Fidus seems to disagree with that idea, noting that OnePlus itself is not PCI-DSS compliant, and that while no information is stored on the OnePlus website, there is a single page still hosted on OnePlus’ infrastructure where card details could be stolen, if an intruder has access.
Fidus seems to have been right on the money, as OnePlus has come back with the initial results of its investigation, and has warned that up to 40,000 customers may have been affected by a security flaw between mid-November 2017 and January 11 2018. That flaw allowed for a malicious script to pick up customers’ credit card details as they were entered onto the site.
OnePlus has reached out to as many of the affected customers as it can, but is urging all of its customers to be vigilant for any unauthorized activity on their credit cards. It’s important to note at this stage that only customers who were inputting their payment details into the site for the first time were susceptible to being attacked by the script, and anyone using a saved payment method is safe from the breach. The latter also applies to anyone who paid via PayPal, either by the usual PayPal payment method, or a credit card via PayPal. However, it’s always worth checking your credit card receipts, just in case.
OnePlus has apologized unreservedly, and has stated that it is working with its credit card authorization company to ensure that this hole is plugged as quickly as possible. It added that it will be working hard to stop anything like this happening again.
OnePlus has been one of Android’s major success stories, with the company coming out of nowhere to become an established name within smartphones. It recently released its OnePlus 5T to great acclaim, and while no stranger to controversy, has generally had good press on its side.
OnePlus is urging anyone who has previously made a purchase on its webstore using a credit card to check their statements and get any unauthorized charges reversed wherever possible.
Update: Updated with the results of the investigation by OnePlus.
