Up to 40,000 customers of smartphone vendor OnePlus may have had their credit card information stolen, the company said on Friday.
A malicious script on the OnePlus.net site secretly recorded customers' credit card details from November 2017—when the company's OnePlus 5T went on sale—to Jan. 11. In a statement, OnePlus apologized for the breach, which came to light a week ago when customers noticed mysterious credit card charges after making purchases on OnePlus.net.
The company sent out emails to customers who are possibly affected. "We recommend that you check your card statements and report any charges you don't recognize to your bank," OnePlus said.
The malicious script was injected into the OnePlus.net payment processing page, lifting credit card data—including number, the expiration date, and the verification code—from victims' browsers as it was entered. However, it operated only intermittently, so not everyone was hit. OnePlus has deleted the malicious code and quarantined the affected server.
Users who made purchases on OnePlus.net via PayPal or through a credit card previously saved with site shouldn't be affected, the vendor said. For now, OnePlus has disabled its credit card payment system, and is currently only accepting purchases through PayPal.
It isn't clear who was behind the hack, but OnePlus is working with its payment providers and local authorities to address the incident. It plans on implementing a a more credit card payment method in the future. "We cannot apologize enough for letting something like this happen," it said.