2026 E-Store ShopServe — app vuln; ~23.356M people (final report)
Data compromised
Final 16 Oct: ~23,356,000 people after de-dupe (buyers/members, shop operators, affiliates) across 7,858 shops (current + former). Buyers: name/address/phone/fax/email/employer/free-text. Members: ID + encrypted password (company: abuse unlikely; shop not linked). Partial cards for ~2,096,900 (name, BIN+last4, expiry; no PAN/CVV). Shop admin logins; konbini-slip shop contacts; affiliate email/password. Store-mail/FTP/payout accounts removed from the leak inventory after forensics. No dark-web dump found at notice.
Technical writeup
Root cause
Application vulnerability on ShopServe servers; attacker ran unauthorized code and exfiltrated the database 21 May–1 Aug 2026. Blocked on discovery 1 Aug. Forensics: no other path, no backdoor. Aug first report had been “up to ~8.85M items.”