E Store published its final report on the unauthorized access to ShopServe on 16 October 2026. Approximately 23,356,000 people and 7,858 stores were affected, including approximately 2,096,900 people whose data included some credit card information.
According to the final report, data was transmitted externally from 21 May to 1 August 2026 through the execution of malware that exploited an application vulnerability on the server. A forensic investigation by an external investigative organization found no evidence of intrusion through any other route or of backdoors being installed.
The affected data extended beyond store information to include purchaser and member information, such as names, addresses, email addresses, member IDs and encrypted passwords. The 7,858 affected stores include stores that had been used in the past, including stores that had canceled their service or migrated to another platform.
The IDs and passwords for store email systems, FTP IDs and passwords, and bank account information for transfers, which were included in the scope as of the second report, were excluded from the final report. Meanwhile, the IDs and passwords for the ShopServe administration screen, as well as the email addresses and passwords of registered affiliates, remain within the scope.
The companies identified in the disclosure include companies and stores that had used ShopServe in the past, and the status of individual notifications varies by company according to the date of disclosure and subsequent updates. The final report established the overall scope of the damage, but the impact on individual stores may not match the publicly disclosed information.