Cyberbiz database intrusion sends Taiwan retailers to the stock exchange

Cyberbiz database intrusion sends Taiwan retailers to the stock exchange

9 November 2026: Listed Taiwanese retailers are filing material notices after Cyberbiz, the e-commerce platform that runs their online stores, reported unauthorised access to part of its database, with order and personal data among what may be exposed. Acer Gadget has shut its store while Cyberbiz investigates, and says it will seek compensation.

Not yet independently verified. Cyberbiz has published no incident statement that we could find, so the cause, the number of merchants and the number of customers are unknown. Only the Acer Gadget filing was read directly; the other filings are as iThome reports them. We will update this when it can be confirmed, and remove this note.

What the filings say

Acer Gadget's notice to the Taiwan Stock Exchange, dated 6 November, gives the clearest timeline. The company learned from the media on the afternoon of 5 November that other Cyberbiz customers had been affected, stopped its online store at once and asked whether it was affected too. Cyberbiz told it the next day and supplied the affected data range. Acer Gadget will notify what it calls a very small number of possibly affected consumers individually, is preparing a report to the regulator, and says there is no material financial or business effect so far.

Taiwan Salt filed on the same day, iThome reports, saying Cyberbiz told it that database content including orders and consumer data from its online shop had been accessed. Cyberbiz had not established the cause, and whether data actually left is not confirmed. Nobel Baby, which runs a pharmacy chain, filed on Sunday 8 November that order data may be affected. Grape King filed on 4 November about its own store. Acer Gadget's subsidiary Acer Fashion has paused its shop as a precaution without having been told it was affected.

Four storefront vendors in a month

Cyberbiz is the latest in a run. iThome counted incidents at 91APP in mid October, at 1shop, which said on 30 October that order confirmation emails had probably been read and which suspects a Mailgun API key, and at meepShop, where merchants reported an attack on 2 November. Brands including Merrell Taiwan, Hayashi and Da Cheng posted fraud warnings about Cyberbiz in early November. iThome asked Cyberbiz and meepShop for comment on 4 November and had no reply by its deadline.

Cyberbiz's own security page carries a general warning that it will never ask for passwords, codes or card data by phone, SMS, email or LINE. It does not mention an incident. The page footer cites ISO/IEC 27001:2022 and PCI DSS certification.

What merchants on these platforms can ask for

The common factor is a hosted platform holding order records for many brands, so the exposure sits with the vendor while the duty to tell customers falls on the merchant. Merchants on any of the four should ask for the affected data range in writing, as Acer Gadget did. The 1shop case points to a second check: which outside services, email senders in particular, hold API keys that can read order messages, and how long those messages are kept. 1shop has replaced its key and stopped storing the emails.

Listed rivals

91APP is listed in our catalogue, and our eCommerce software category holds six products. Cyberbiz, 1shop and meepShop are not yet listed.

Sources

• Taiwan Stock Exchange MOPS: Acer Gadget (2432) material information, outsourced online store provider security incident, 6 November 2026
• iThome: Taiwan Salt online store outsourced provider database accessed without authorisation, 9 November 2026
• iThome: Nobel Baby filing on Cyberbiz, 9 November 2026
• iThome: Grape King filing on Cyberbiz, 5 November 2026
• iThome: after 91APP, security warnings at 1shop, Cyberbiz and meepShop, 4 November 2026
• Cyberbiz: security notice (no date on page, read 2026-11-09), 9 November 2026