Estore: shopper data leaked from ShopServe

At ShopServe, the e-commerce platform run by BASE subsidiary Estore, an outsider exploited an application vulnerability to run a malicious program and sent database contents out from 21 May to 1 August 2026. Estore noticed on 1 August and cut the connection. Its final report on 16 October said about 23,356,000 shoppers, members, shop operators and affiliates were affected: names, addresses, phone numbers, emails, employers, encrypted passwords, shop admin logins and more leaked. About 2,096,900 of them also had cardholder names, partial card numbers and expiry dates leaked. 7,858 shops were affected.