91APP breach traced to ARTEX and unpatched Appsmith flaw
91APP’s 18-day investigation found traces of the AI-powered ARTEX penetration-testing system in its environment and identified an unpatched Appsmith vulnerability as the main intrusion path. The investigation found that one Commerce Cloud order database was accessed and that order information, but not credit-card payment details, was involved; the intrusion was blocked on October 14. 91APP removed the compromised tool, rotated credentials and tokens, rebuilt GitLab permissions, and restricted CI-host and database-network connections, while the affected brands, member count, and exact data scope remained under investigation.
91APP’s report documents a concrete intrusion involving AI-automated attack tooling and an unpatched third-party application, while disclosing several containment measures and leaving the full scope unresolved.
電商技術服務業者91APP日前發布資安重大訊息，揭露旗下Commerce Cloud資料庫遭自動化攻擊，部分資訊遭非法擷取，不過當時並未說明具體入侵途徑。如今該公司於10月22日公布《91APP 2026遭受駭客攻擊事件18天調查報告》，揭露系統內發現ARTEX自動化攻擊工具的痕跡，也說明此次入侵的主要破口，是第三方工具Appsmith的漏洞未及時修補。
根據91APP公布的事件時間軸，該公司從10月4日接獲客戶通報後展開調查，由於詐騙訊息與系統資料不符，91APP最初先協助客戶調查ERP系統。隨著10月7日通報增加，，加上非91APP客戶也出現類似詐騙情形，公司於隔日成立緊急應變小組，決議委聘外部資安團隊，並於10月9日確認由奧義智慧科技協助調查。
直到10月14日，91APP終於確認自身遭駭。調查團隊從一臺內部持續整合（CI）主機中，發現10月3日有一支未授權執行緒的執行紀錄，進一步還原駭客攻擊軌跡，查出Commerce Cloud有一個訂單資料庫遭非法存取，並於當日阻斷入侵。
#91APP#ARTEX#Appsmith#91APP Commerce Cloud#GitLab#91APP Payments#iCHEF#AOMEI Technology