91APP expands breach to 4,798,255 consumers across 1,329 brands
91APP, a Taiwanese retail-software provider, said in an Oct 29 update that attackers accessed an order database in its Commerce Cloud. Unable to determine whose data was actually taken, the company disclosed the maximum potential scope: up to 1,329 brands and 4,798,255 consumers, covering online orders placed Apr 4, 2025 through Oct 14, 2026. Names, phone numbers, delivery addresses, emails and order records were potentially exposed, with no passwords or payment data; the company says shoppers are already getting scam messages, and notifications start Nov 2.
What happened
91APP, a Taiwanese retail-software provider, confirmed that attackers accessed an order database in its Commerce Cloud. In an Oct 29 update, the company expanded the potential breach scope to up to 1,329 brands and 4,798,255 consumers. MUJI Taiwan confirmed some of its online-store orders were in the database.
Why it matters
Customer data from hundreds of brands on the platform was potentially exposed: names, phone numbers, delivery addresses, emails and order records. 91APP itself says shoppers are already receiving scam messages, so expect phishing that quotes real order details.
What to do
Warn customers about scam risk, state that 91APP will not request data by message, and tell them not to click links in SMS or email about orders. Track official notifications starting Nov 2 and review incident response with e-commerce vendors.
For the technical team
- Affected
- 91APP, provedora taiwanesa de software de varejo; banco de dados de pedidos do Commerce Cloud com dados de até 1.329 mar · 91APP Commerce Cloud, order database: online orders placed Apr 4, 2025 through Oct 14, 2026, from up to 1,329 brands and 4,798,255 consumers.
- Exploitation
- Data breach, not a vulnerability. 91APP acknowledges shoppers are already getting scam messages quoting order details. Per DailyDarkWeb, the figures are notification scope, not a confirmed count of stolen records.
- Fix
- No fix applicable (data breach). 91APP says the attack was blocked on Oct 14; email/SMS notifications planned from Nov 2, subject to brand authorization.
- Vector
- Attackers accessed an order database in 91APP's Commerce Cloud; the source does not describe the technical entry vector.
- More details
- Timeline per 91APP (ticker 6741): intrusion Oct 3, first brand report Oct 4, attack blocked Oct 14, initial disclosure Oct 16, scope update Oct 29. Potentially exposed data: names, phone numbers, delivery addresses, emails (where provided) and order records; no passwords, card or payment data. MUJI Taiwan confirmed some of its online-store orders were in the database. DailyDarkWeb notes this is separate from Japan's MUJI app disclosure.
Timeline
91APP update expands the potential breach scope to 4.8 million consumers across 1,329 brands.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
