91APP Inc. told regulators and investors on October 29 that up to 4,798,255 consumers who ordered through brand sites between April 4, 2025 and October 14, 2026 could be inside the maximum breach scope, and it opened a single compensation desk rather than forcing shoppers to chase 1,329 merchants separately.
The company stressed that passwords, card numbers, and payment tokens were not in the accessed order database, but names, phone numbers, delivery addresses, emails where collected, and full order histories might be. That detail mix is exactly what powers convincing refund scams — messages that cite real items and amounts — which is why FamilyMart's mobile shopping unit and MUJI Taiwan both issued customer warnings even before every brand finished authorizing 91APP to email on their behalf.
What shoppers should expect in the inbox
Notifications began November 2 by email when an address exists, otherwise by SMS. Receiving one means the consumer is inside 91APP's widest reasonable set, not that every data field leaked. Conversely, someone who shopped on an affected brand site but hears nothing may still be in queue pending brand authorization for centralized outreach.
Registration for compensation runs through February 1, 2027. Shoppers without financial loss file personal-data harm forms; confirmed fraud losses go through a property-damage track. Hotline hours published by the company are weekdays 9:00–18:00 at (02) 7723-1622 with a dedicated mailbox at servicetw@91app.com.
How the attack fits Taiwan's scam wave
CyCraft Technology, retained as an outside investigator, traced the intrusion to a compromised internal Appsmith deployment and database keys stored in GitLab, a path similar to automated ARTEX-tool incidents reported in South Korea and Japan during September and October. 91APP blocked access on October 14, filed with police and the Ministry of Digital Affairs on October 15, and kept Commerce Cloud's other modules running through the fourth-quarter retail peak.
The Criminal Investigation Bureau separately warned on November 7 that QR-code refund pages are binding mobile wallets when victims follow fake customer-service scripts. Breach notices from @91app.com explicitly say they will never ask for account numbers, one-time passwords, or ATM steps — a line consumers should cross-check against any message that arrives after reading a genuine notice.
Brand-side liability and household steps
FamilyMart said it would seek indemnity from 91APP if members suffer verified losses. MUJI Taiwan limited exposure to web orders in the date window and excluded brick-and-mortar tills. For households, the checklist is boring but effective: freeze repeat-purchase accounts if messages spike, refuse QR refunds, and log scam attempts through the 165 hotline even when no money moves.
Digital Affairs conducted an on-site inspection October 19 and confirmed the attack was contained as of October 21. Financial impact on 91APP's listed parent remains under assessment, but for Taiwan shoppers the near-term cost is vigilance — multiplied by millions of real receipts now circulating in criminal templates.