Several customers of the Chinese smartphone manufacturer. claim to have been the victim of fraudulent credit card transactions after making purchases on the company webstore. Security researchers at Fidus analyzed the payment page after reading the claims on the official forum and discovered that card details are hosted ON-SITE exposing data to attacks. Experts speculate the servers of the company website might have been compromised, likely the attackers exploited some flaws in the Magento eCommerce platform used by OnePlus. The company declared that it does not store any credit card data on its website and all payment transactions are carried out through a payment processing partner.”]
Source: https://securityaffairs.co/wordpress/67790/data-breach/oneplus-card-frauds.html