OnePlus hacked as customers are warned of a serious breach

Card numbers, expiry dates and security codes have been nabbed from OnePlus.net

OnePlus, the Chinese smartphone brand that asks you to "never settle", last week admitted it's faced a widespread credit card hack. In a letter to its customers, along with a post on its forums, OnePlus apologised for the breach and stated that the card number, expiry date and security code of customers' credit cards have all been compromised.

It's unclear exactly when this attack took place and for how long OnePlus has been sitting on the information, but it told customers that it "launched an urgent investigation" as soon as it was made aware of the attack. It also "suspended credit card payments" and has "been working with a cybersecurity firm to reinforce [its] systems".

OnePlus recommended that every customer checks their card statements and report any charges they don't recognise. It also stated that "if you run into any problems, or need further guidance, don't hesitate to reach out".

The hack occurred thanks to a malicious script inserted into the OnePlus.net payment page code. This allowed hackers to see customers' credit card numbers, expiration dates and security codes - essentially all the information needed to use a card for a fraudulent payment.

On the surface, the hack seems reminiscent of the session replay scripts that shook the internet back in November.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

You can read OnePlus's full letter to affected customers below, posted by Peter Smallbone on Twitter.

Currently, the company is uncertain of just how many customers have been affected. They've managed to track down the code's insertion to sometime in mid-November, just before the OnePlus 5T launch. There are a potential 40,000 affected customers but all those who had saved their credit card info into OnePlus' systems before mid-November won't be affected, nor were PayPal customers.

OnePlus said it's looking for "a suitable way to offer one year's credit monitoring to affected users". This should mean that any abnormal or fraudulent payments on your credit card will be pinged to you as soon as they happen. OnePlus added that it will be getting in touch with affected users soon to ensure they can claim their credit monitoring service.

As with all of these incidents, affected customers' best course of action is to cancel all credit or debit cards that may have been compromised. Also, customers are advised to contact their banks and make sure that they're aware of the breach and can provide monitoring services just in case.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
Visit/policy-legislation/data-protection/354492/currys-pc-world-parent-firm-hit-with-ps500k-fine-over
data protection

Currys PC World parent firm hit with £500k fine over historic data breach

9 Jan 2020
Visit/security/ransomware/354483/travelex-disruption-caused-by-devastating-ransomware-attack
ransomware

Travelex disruption caused by devastating ransomware attack

8 Jan 2020