91APP database attack spreads to brands as Taiwan opens an inspection

91APP database attack spreads to brands as Taiwan opens an inspection

22 October 2026: 91APP (stock code 6741), a Taiwanese e-commerce software company, says an automated attack on its Commerce Cloud database took some data, and the fallout is now reaching the retail brands that run their online shops on it. Taiwan's Digital Industry Administration, part of the Ministry of Digital Affairs, says it inspected the company on 19 October with the National Institute of Cyber Security and outside experts, and will act under the Personal Data Protection Act if it finds breaches.

Not yet independently verified. Neither 91APP nor the regulator has said how many brands, customers or records are affected; the 3 October date of the first attack records comes from a company spokesperson quoted by the press. We will update this when it can be confirmed, and remove this note.

What 91APP has said

In a stock exchange filing and a statement on its own site on 16 October, 91APP said it had found that its Commerce Cloud database had been subjected to an automated attack and that some information had been illegally taken. It says the situation is under control and it has reported the attack to the police. It has started its personal-data incident procedure, brought in an independent third-party security firm, notified the authorities as the law requires, and emailed affected customers with anti-fraud warnings. Its listed measures are round-the-clock monitoring, protection on the affected servers, tighter separation between its own systems, third-party systems and its office network, and further improvements as the investigation proceeds.

iThome reports that 91APP found the attack on 14 October. A company spokesperson told Taiwanese media that brands had reported suspicious emails from early October, that forensics by the security firm CyCraft confirmed the intrusion on 14 October, and that attack records go back to 3 October.

Brands and their customers

The brands are where the data surfaces. The Japanese second-hand fashion chain 2nd STREET TAIWAN says customers began receiving emails in its name containing their personal and order details from the afternoon of 12 October. The listed apparel company 滿心 (stock code 2916) filed its own material notice on 19 October about a suspected leak from an outsourced platform, and its website ties it to 91APP. The sports retailer Momentum and the publishing group 尖端媒體集團 have also warned customers; one scam email in the publisher's name claimed a duplicate order to be charged in 12 instalments, a total of NT$13,692, and pointed victims to a fake LINE support account.

What the regulator wants to know

The Digital Industry Administration says some data was clearly accessed without authorisation but that the kinds of personal data, the number of people and the number of records are not yet confirmed. It has asked 91APP to inventory what was taken, which brands and consumers are involved, and to notify them, and it is examining how the attackers got the data, whether database permissions and anomaly detection were adequate, and whether other systems were affected. For brands on any shared commerce platform, the case shows the gap that matters: customers were receiving convincing scams days before the platform confirmed the intrusion. Our B2B e-commerce platform category lists ten products.

Company profile on TrustList: 91APP

Sources

• 91APP: Statement on the automated attack on the Commerce Cloud database (in Chinese), 16 October 2026
• iThome: Digital Industry Administration starts administrative inspection of 91APP (in Chinese), 22 October 2026
• iThome: 91APP incident spreads as partner brands warn of scam emails (in Chinese), 22 October 2026