1shop says order-confirmation emails were likely stolen, rotates Mailgun key, and warns of fake subscription scams

E-commerce store platform 1shop said on 30 October 2026 that on the evening of 28 October it received reports from merchants and customers of scam emails that misused order details, claiming a 12-installment subscription and asking recipients to add a LINE account or click a link to cancel ^[1]. The company said the names, items and amounts in the emails broadly matched real orders, but the purported first-order date matched the confirmation-email send time and the shipping address was fake, so it concluded the attackers obtained confirmation-email content rather than payment or login data; it also said the long-standing Mailgun API key used to send those notices may have been obtained, has deleted the old key, stopped retaining notice content, reissued old order short URLs, notified the authorities, and emailed possibly affected customers ^[1]. 1shop asks merchants to tell customers that these messages were not sent by the store or the platform, and that requests to add LINE, click a link, or use an ATM or online banking to “cancel a setting” are scams; if someone has already been contacted or has transferred money, they should call Taiwan’s 165 anti-fraud hotline ^[1].

Industries mainly affected: Retail, Technology