Do you have OnePlus smartphone? If you do, make sure to check your bank account now. The Chinese smartphone manufacturer finally admitted that its official website was hacked back in November 2017. Actually, rumors about the information breach have been around during the last week, but OnePlus did not confirm the issues. Hundreds of customers complained about fraud on their credit card accounts or bank accounts after using OnePlus website to make payment.
One of OnePlus representative admitted on Friday that it had been breached. As a result, about 40.000 of its customers were at the risk of personal data stealing. It seems that the hackers targeted credit card information. Pitfalls on OnePlus website were confirmed by Fidus Information Security – a cyber security company based in the United Kingdom.
OnePlus Website Was Installed with Malicious Code
After recognizing the attacks, the company immediately took actions to see how the hackers got into the website. They found that the hackers broke into the website server. Then, they installed malicious Javascript code to steal information on credit card accounts. The company informed the customers on the attacked on Friday by means of email.
The notification included information on the victim credit card numbers, security codes, and expiry dates. The victims are customers who entered the data into OnePlus official website from mid-November 2017 to January 11, 2018. About 40.000 customers were at risks. However, the company reported that customers that had saved credit card information should not be affected. The same case applies for customers who used PayPal for payment or transfer.
The Fidus representative said that his agency had identified the vulnerability, which allowed the hackers to get access into the website. The problem is actually not with the website itself. Instead, the weakest link might be related to Magento eCommerce platform used on OnePlus website.
Furthermore, he said that the payment integration platform had been previously hacked for several occasions. It is a frequent target of hackers. A number of reports have noted that the attack attempts had come since the first year they used the credit card to purchase items and make payment from the manufacturer’s website.
Response about OnePlus website Attacks
Most people blamed OnePlus for the attacked. Andrew Mabbitt from Fidus Information Security said that if the company used a strong a firewall protection, the problem should not have happened. However, the company representative said that they could not be fully blamed for the problem. OnePlus had been working with payment providers to implement a more secured payment method via credit card. The company is also conducting an in-depth and comprehensive security audit for its website.
In response to the attacks, OnePlus is now providing free credit monitoring for the customers that become the victims. The smartphone maker also reported the problems to law enforcement and data protection authorities in the regions, where it operates. Another important step taken by the company is attempting to improve its security. The company is collaborating with internet security providers to improve the system and to make sure that the similar problem will never happen in the future.