Taiwanese e-commerce platform 91APP has confirmed that an attacker broke into one of its Commerce Cloud order databases. The company says up to 4,798,255 consumers who shopped with 1,329 brands may be affected. That figure is a worst-case estimate. 91APP's 25-day investigation report, published on 29 October 2026 and filed with Taiwan's Market Observation Post System, says the company cannot tell which orders were actually accessed. It therefore treats every online order placed between 4 April 2025 and 14 October 2026 as possibly exposed. Central News Agency (CNA) quotes the company as saying "some" of the data was stolen. Investigators found traces of ARTEX, an AI penetration-testing tool that has also been used in attacks in South Korea and Japan this autumn. The way in was a known flaw in an internal Appsmith tool that 91APP had not patched.
What Happened
91APP's own statements, and reporting by iThome, CNA and EffectStory, give this timeline:
- 3 October, 11:00: An attacker accesses one Commerce Cloud order database. On the same day, an unauthorised process runs on an internal CI (build) server.
- 4 October: A brand customer first tells 91APP that its shoppers are receiving scam messages. According to iThome, the scam messages did not match 91APP's system data at first, so the company started by helping the customer check its own ERP system.
- 7 October: Five more brands report scams in a single day. Shoppers of brands that do not use 91APP also report similar scams.
- 8 October: 91APP sets up an emergency response team and decides to hire outside investigators.
- 9 October: Taiwanese security firm CyCraft Technology is brought in.
- 14 October: Investigators find the unauthorised activity on the CI server, confirm the breach, and block the intrusion at 23:00.
- 15 October: 91APP reports the incident to police and to the Ministry of Digital Affairs, as Taiwan's Personal Data Protection Act requires.
- 16 October: 91APP issues a material-information filing to the stock exchange.
- 19 October: The ministry's digital industry agency carries out an on-site inspection. On 21 October the company confirms again that the attack is fully blocked.
- 22 October: 91APP publishes its 18-day report, naming the entry point and the ARTEX traces.
- 29 October: The 25-day report gives the maximum affected scope. Chairman Ho Ying-chi and senior managers bow in apology at a press conference.
- 2 November: Once each brand gives permission, 91APP starts notifying affected consumers by email and SMS.
From the first customer report to blocking the attack took ten days. Ho has publicly admitted that 91APP should have warned brands when it set up its response team on 8 October, and called the delay "91APP's mistake." 91APP's financial filing says the financial impact is still being assessed. Vice President Cheng Kai-yu told reporters the company cannot yet estimate the cost of compensation.
What Was Taken
According to 91APP's filing and CNA's reporting, the breached system was a short-term order database holding up to 18 months of transactions. The data possibly exposed includes:
- Names
- Phone numbers
- Delivery addresses
- Email addresses (where the shopper gave one)
- Order records
The company says no passwords, credit card numbers or payment data were in the database. It also says Marketing Cloud, 91APP Payments and its iCHEF restaurant platform were not affected.
The scope estimate changed over time. Up to 22 October, 91APP, iThome and the Hong Kong outlet TechLab all reported that the number of affected brands and shoppers was still unknown. The 4,798,255 figure appeared only in the 29 October report. It is a deliberately cautious upper bound, not a count of confirmed victims. 91APP says being inside that range "does not mean every consumer's data was leaked." Every outlet reporting the figure uses the same company number, so there is no independent count to compare it against.
The leak has already caused real harm. Diet-U, one of the affected brands, says scam emails pretending to be from Diet-U started arriving on the day it was notified. The emails falsely claimed shoppers had signed up for repeat-subscription orders. They then directed victims to a fake LINE customer-service account, then to fake "payment processor" or bank staff, who talked them through ATM transfers and online banking. Diet-U says some of its members have lost money. 91APP says it will fully compensate consumers who suffered losses. Affected shoppers can apply for compensation until 1 February 2027, whether or not they lost money.
Why It Matters
A single platform put more than a thousand brands at risk. Each brand on 91APP's software-as-a-service platform had its customer data in shared infrastructure. A single internal weakness at the provider exposed shoppers from all of them. Most brands only found out after their customers were already being targeted by scammers.
The ten-day delay matters as much as the break-in. The scams started hitting shoppers on 4 October, more than a week before the breach was confirmed. Brands that heard nothing from their platform during that time could not warn customers or tighten checks on who was calling them as "customer service." This is the main lesson TechLab draws: set a threshold for early risk warnings, so customers can act before the root cause is confirmed.
This is part of a wider ARTEX campaign, but who is behind it is still unclear. TECHNOVA, citing Wiz, reports that ARTEX was published on GitHub in July 2026 by a developer in China. The developer took the repository down on 8 October, by which time it had more than 12,000 forks. TECHNOVA summarises other vendors' reports as follows:
- CrowdStrike and Zscaler report attacks on South Korean financial institutions from late September. Zscaler says about 67,000 people's records were stolen.
- GMO Cybersecurity by Ierae says about 20 Japanese companies were targeted.
- Microsoft ties ARTEX activity to Storm-0940, a group it describes as aligned with the Chinese state, targeting hundreds of organisations.
According to TECHNOVA, Wiz notes that Microsoft and Zscaler link the activity to different actors. GMO Ierae has said the developer's nationality tells you nothing about who is using the tool. 91APP has not attributed its breach to any group. As TechLab points out, finding traces of a tool does not prove who used it or why. No one has publicly linked the Taiwan intrusion to a specific actor.
The Attack Technique
91APP's 18-day report describes the intrusion chain clearly:
- Way in: A vulnerability in Appsmith, a third-party low-code tool for building internal apps. 91APP had not applied the patch. The company has not said which version or CVE was involved, or whether the tool could be reached from the internet. The Taiwanese security blog Fangbao Biji (防暴筆記) lists these as open questions.
- Moving through the network: From Appsmith, the attacker got into 91APP's internal network. An unauthorised process ran on an internal CI server on 3 October.
- Stealing a credential: The attacker found a key for one order database in the company's internal GitLab. 91APP has not said whether it was in a code repository or a CI variable.
- Taking the data: Using that key, the attacker connected directly to the database and read order data.
Two of 91APP's fixes reveal how the network was set up. The company says it "restricted connections between the CI server and the database network segment," which suggests the CI network could reach the production database directly. It also says it disabled impersonated accounts. Fangbao Biji makes the point that once the attacker used a real database credential, their queries would have looked like normal application traffic. That may help explain why the activity went unnoticed for days.
91APP's other fixes: it removed the compromised Appsmith instance, replaced internal system tokens, changed database accounts and passwords, rebuilt GitLab permissions, and kept forensic copies of the compromised hosts. The company says ARTEX, as an autonomous AI pentesting system, can find vulnerabilities, plan an attack path and steal data with little human input. It also says a new tool does not reduce its own responsibility, because its patching and defences had not kept up with how fast attacks now move.
What Organizations Should Do
- List and patch your internal tools. Record every self-hosted internal tool (Appsmith, Retool, n8n, Metabase, Jenkins, GitLab) with its version, and check each against the latest release. Keep these tools off the public internet. Shut down instances nobody uses any more.
- Get secrets out of code. Scan repositories and their full history for database credentials and connection strings, for example with
gitleaks. Move secrets into a secrets manager or use short-lived credentials. Check which secrets your CI runners and pipeline variables can read. - Split up your network. Production databases should only accept connections from the application tier. CI hosts, code platforms and admin tools should not be able to reach production data directly.
- Change credentials that may have been seen. Any database account, token or deploy credential stored in a system that might have been compromised should be replaced, and the old ones revoked.
- Watch for valid credentials being misused. Alert on database logins from unexpected hosts or network segments, unusual query volumes, and unexpected processes on CI servers. This attack used a real key, so signature-based detection would not have caught it.
- Warn customers early. Platform providers should agree with their customers in advance on when to send a first warning before the cause is confirmed. Brands should prepare anti-fraud messaging that is ready to send. In this case, scam calls and messages that quoted real order details reached shoppers days before anyone confirmed the breach.
Sources: 91APP breach may affect up to 4.8 million shoppers EffectStory | 【重要公告】大侑防詐騙提醒（系統服務商91APP資安事件說明） 大侑DIET-U官方網站 | 門是一個沒更新的內部工具，鑰匙就放在 GitLab 裡 · 防暴筆記 | 91APP Breach Traced to Unpatched Appsmith and ARTEX AI Tool Effect... | AIの侵入テストの道具「ARTEX」、台湾の通販の基盤でも悪用 韓国・日本に続き TECHNOVA | 91APP遭駭事件查出ARTEX攻擊痕跡，顯示不只日韓，臺灣也出現相關攻擊案例 iThome | 91APP：被駭事件恐影響479萬消費者 開放補償申請 產經 中央社 CNA | 91APP入侵鏈揭示：未修補 Appsmith 如何通往訂單資料庫 · TechLab