91APP Commerce Cloud Order Database Breached: Unpatched Appsmith Exploited as Entry Point; Member Order Data Across Brands Leaked and Abused for Scams

What Happened

According to 91APP's incident statement, after receiving an initial customer report on October 4, its investigation confirmed on October 14 that one of the Commerce Cloud order databases had been illegally accessed on October 3; the root cause was an unpatched vulnerability in the third-party tool Appsmith, which allowed attackers to penetrate the internal network and obtain database credentials from an internal GitLab server ^[1]. 91APP also stated that it discovered traces of the autonomous AI penetration tool ARTEX within its systems ^[1].

Scope of Impact

On October 19, the Administration for Digital Industries (ADI), MODA, together with the National Institute of Cyber Security (NICS) and external experts, conducted an on-site inspection confirming that data had indeed been exfiltrated without authorization, though the specific personal data fields, number of individuals, and record counts remain under investigation ^[2]. The accessed data consisted of order information and did not include credit card details; Marketing Cloud, 91APP Payments, and iCHEF were unaffected ^[1]. Multiple listed companies using 91APP (including Munsin, Atunas, Kemao Biotechnology, Sea Mild, and Li Kang) subsequently issued material cybersecurity filings on MOPS, and consumers reported receiving emails impersonating merchants with real order details ^[3].

Response

91APP has removed Appsmith, rotated internal tokens and database credentials, restricted network connectivity between CI hosts and database segments, reported the breach to MODA under the Personal Data Protection Act on October 15, and proposed a consumer financial loss compensation and brand member communication plan ^[1]. ADI has initiated an administrative inspection requiring 91APP to inventory the exfiltrated data and notify affected brands and consumers .