CONFIDENTIAL CONTACT
Does a platform incident involve your brand?
Start with a redacted map of data flows, notices and unanswered questions before sharing sensitive records.
The data may sit on a vendor platform, but the customer will ask your brand what happened. When the vendor says it is still investigating, should a merchant wait for a final number or first establish which records it sent to the platform?
An unknown scope is not the same as no impact. That distinction should govern every internal memo and customer response.
Establish the facts and gaps before deciding on investigation or legal action.
On 20 October 2026, Taiwan’s Administration for Digital Industries said 91APP had announced unauthorised extraction from its Commerce Cloud database following an automated attack. An administrative inspection was under way. The types and number of affected records and people remained unconfirmed that day.
That statement does not establish that every merchant or customer was affected. It gives merchants a reason to request a verifiable scope and update schedule rather than fill gaps with rumours.
A brand should know what fields it shares, why, for how long and who may access them. Written responsibilities may be clear while the actual route of an order through membership, payment and delivery systems remains hard to reconstruct.
Trace one real order flow and document each transfer. That gives counsel and security staff a useful map for assessing whether any notice is required.
The regulator warned that consumers should verify supposed order, refund or account notices through their existing official website or app and avoid unknown links, passwords and codes. Merchants can use a single verified support route to reinforce that advice.
Do not claim zero risk while scope is unresolved. If notification is required, let the facts and applicable rules guide it; keep a dated record of each correction.
Within an authorised scope, we can organise data-flow records, notice versions, a timeline and unresolved questions for counsel and security specialists.
We do not replace the regulator, promise complete attribution or make statutory notification decisions. Technical examination needs the appropriate access and qualified team.
A merchant need not wait for a vendor to declare the matter closed before identifying its own records and unanswered questions.
A credible answer can say what is known, what is not and when the next update will be available.
Start with a redacted map of data flows, notices and unanswered questions before sharing sensitive records.
