Attention 4.8 million people! You can apply for 91APP compensation even if you haven’t been defrauded. See the steps and qualifications at once

A major information security incident recently broke out in the e-commerce system service provider 91APP. Due to the large number of cooperative brands, including Baoya, Cosmetics, adidas and MUJI, it has been implicated in a huge amount. 91APP also confirmed that this incident may involve up to 1,329 brands and affect approximately 4.8 million people.

In order to restore its reputation, 91APP has launched a compensation application mechanism. However, it initially used a Google form to fill in the form, which caused netizens to criticize it as "zero points for information security." 91APP then urgently changed its official website to accept applications. At the same time, it stated that applications that had been submitted through the Google form did not need to be filled in again.

According to 91APP’s instructions, as long as you place an order through the brand’s official website or app using the 91APP system between April 4, 2025 and October 14, 2026, the relevant order information may be accessed by hackers.

Since 91APP cannot confirm which consumers' information was actually stolen, all consumers within the above-mentioned affected range will be included in the notification and compensation targets. If it falls within the affected area, you will receive a notification letter from 91APP and can apply for compensation on the official website.

There are two main types of compensation. One is "property loss compensation", that is, consumers who have actually been defrauded and suffered monetary losses; the other is "personal data damage compensation". Even if there is no property loss, as long as personal data is affected, you can still apply.

However, if it is compensation for property damage, the report document and case number must be provided, as well as fraud-related proof, such as screenshots of conversations with the fraud group, etc. As for compensation for personal data damage, although you can apply without actual financial loss, you must still explain the damage to your personal data in the form. In addition, if orders from different brands are involved, the application information must be filled in separately.

91APP has not yet announced the actual compensation amount and specific methods. The relevant content will be notified separately after the application deadline on February 1, 2027.

As for the information that may be leaked, 91APP stated that the personal information involved includes names, phone numbers, shipping addresses, emails, order records, etc., but does not include credit card information and member login passwords.

91APP also reminds consumers to be more vigilant. The official notification will not require people to click on the link in the notification to fill in personal information, nor will it require people to join LINE, operate an ATM, or provide account numbers, passwords and financial information to avoid falling into fraud traps after personal information leaks.