Android phone maker OnePlus was forced to shut down credit card payments on its website last week after numerous reports from customers of fraudulent charges. Today, the company has announced the preliminary results of its investigation, showing that as many as 40,000 customers may have had their credit card details stolen. It turns out a malicious script has been hiding on its website for about two months.

According to OnePlus, an unknown attacker accessed one of its servers in mid-November and implanted a script, which siphoned payment details from customers when they entered their payment information in OnePlus’ online store. The stolen data included the card number, security code, and billing information. That’s everything you need to use the card. The code ran intermittently over the coming weeks until credit card payments were shut off on January 11th, 2018.

Read full news article on Extreme Tech