The attacker entered through the internal tool Appsmith, obtained a database key from GitLab and accessed an order database. No credit card or other payment information was involved. The stolen data was later used in scam messages targeting brand customers.
Confirmed victims
- 91APP
- Platform brand customers and their consumers
Attribution
- ARTEX basis
- 91APP's own report of Oct 22 says traces of ARTEX were found in its systems.
- Actor
- Not named. Described as using AI automation tools.
- Same attacker?
- Sources do not state a link to other cases.
Figures and definitions
| Scope | 1,329 brands, 4,798,255 consumers (91APP's determination by maximum possible scope; an upper limit, not a confirmed leak count) |
|---|---|
| Early figures | Dozens of brands; the last six months or so, or two months |
| Incident date | Material information filing says Oct 14; letter to brands says Oct 3 |
Sources (4)
- 2026-10-22 Victim 91APP 91APP公布《2026 遭受駭客攻擊事件 18 天調查報告》
- 2026-10-23 Media ISMG (BankInfoSecurity Asia) Artex AI Hacking Tool Used to Breach Taiwan's 91APP
- 2026-10-25 Media 工商時報 91APP遭駭, 為何品牌先挨罵？電商老闆吐苦水 詐騙信風暴始末一次看
- 2026-10-29 Media 優分析 91APP遭駭客入侵訂單資料庫 受害消費者恐近480萬人