"Only a small subset of our customers is affected," a spokesperson for the company told TechCrunch. OnePlus has sent out emails to users it believes may have been impacted after a malicious code was inserted into the company's payment page, designed to sniff out credit card numbers.
"The malicious script operated intermittently, capturing and sending data directly from the user's browser. It has since been eliminated," a spokesperson wrote in the forum post. The company adds that it's since taken action, by quarantining the affected server and putting additional safeguards in place.
The company disabled credit card transactions a few days back, after customers began noticing fraudulent charges on their account. It did, however, continue payments made through Paypal, which appear to not have been impacted by the hack. Customers using a card number entered prior to the aforementioned timeline also appear not to have been impacted by all of this. Card payments are currently still disabled on the site.
OnePlus' fanbase has remained fairly loyal to it, in spite of a handful of very bumbles during its short history. As The Verge notes, the company is also looking to make an aggressive push into the U.S. through carrier deals and doesn't believe this latest issue will have much of a direct impact on its chances.