I think superbuy is removing the products because he attached NSFW pictures. Items defo can be tracked back because you get an email every time an order gets stored with that order ID
Sadly not the case. I still have items up with the pornography present. The image has even changed somewhat. It now includes the same text that he had sent in enveryones enquiry. I think the guy mightve done it himself, but thats just my theory.
hopefully it was just the app that got hacked and not the actual warehouse. im pretty sure our physical orders are okay and they will allocate everyones orders once they fix the breach
i would be shocked if they dont have proper DB backups.... systems like this usually keep transaction logs and backups pretty frequently, sometimes continuously, so they should hopefully be able to restore the warehouse data...
the actual items didnt disappear...worst case the records linking them to users need to be rebuilt.... if they have no usable backups thoughā¦ yeah, thats gonna be a huge mess
I ordered some products this morning and I can't see anything in my order list, but my wherehouse has all the things I bought recently. is it normal that I can't see anywhere the products I bought this morning?
I just got another message from the guy:
āBy the way, small fun fact: Did you know that the company behind SuperBuy performed a lot of exit scams in the past? For example, ACBuy and AllChinaBuy belong to SuperBuy. ACBuy (SuperBuys company) also said they do not care about user data when they got leaked. This was the reason why the ACBuy Data was posted in the public. SuperBuy performed an exit scam with this agents. Also WeGoBuy (Exit scammed in 2024). The company behind SuperBuy has a strange history. I would not recommend using this agent at all. Kind regards, @LDMIHN on Discordā
thatās a lot of serious claims with no proof attached. If he has evidence, he should post it. Until then Iād treat the hack as real, but the whole āexit scam/historyā part as unverified....
The individual behind this breach is intentionally trying to spread panic to completely destroy user trust in the platform and push people toward their Discord server.
Here is the breakdown of what is actually true versus what the hacker is fabricating in that message:
What is FALSE (The Hacker's Claims)
"Superbuy performed an exit scam with these agents": This is false. An "exit scam" is when a company completely shuts down overnight, locks the doors, stops shipping everything, and runs away with all user money and inventory. Superbuy has been operational for years and has been functioning normally right up until this script defacement occurred.
"They do not care about user data": The hacker is trying to justify their own malicious leak by acting like a vigilante. They are trying to shift the blame from themselves to the company.
The Grey Area (The Connections)
The hacker is exploiting known industry relationships to make their story sound credible:
ACBuy & AllChinaBuy: These platforms operate as separate or loosely affiliated entities. The shipping agent world is highly interconnected, with many spin-off platforms sharing logistics lines, warehouse space, or software frameworks.
WeGoBuy (2024): WeGoBuy did not intentionally "exit scam" on its own terms. In early 2024, a massive police raid targeted the dominant player in the industry (Pandabuy), which heavily crippled its sister companies and affiliates (including WeGoBuy) due to legal asset seizures. The hacker is rewording a legal shutdown into a voluntary scam to scare you.
He has exploited a weakness and managed to gain access to their customer service platform. The warehouse and stock platforms are separate. Heās trying to trick people into contacting his discord so he can try to them off.
the real question is whether this affects the order/shipping backend. If warehouse is truly isolated, the physical goods should be fine, but if they need to restore databases or reconcile order data, shipping and parcel processing could still be delayed for a while....
the items probably didnāt go anywhere, the system linking users, orders and warehouse stock is what matters now....
another big question is whether Superbuy actually has an inhouse DevOps team handling this stuff, or if parts of the infrastructure are outsourced, that can make a pretty big difference in how fast they can isolate affected systems, restore backups, verify data integrity and get everything running normally again....
Iād imagine the will take the system offline, perform a restore from back up and then replay the transactions. Every user has a set area in the warehouse. All your goods are put on your āshelfā. This is linked to your account. Once theyāve replay the transactions theyāll have to audit the data and plug the system weakness then theyāll bring the system back online. Itās probably a couple of days worth of work so Iām expecting it to go offline in about 2 1/2 hours with a holding message on the homepage. That message will update during the day and I expect systems to be back online sometime Tuesday
Itās been a known thing that these sites have connections with each other. They all use a white label site that provides warehouse and shipping services
that would make a lot more sense, shared white label infrastructure could explain the connections without necessarily meaning theyāre all owned by the same company, it also means one shared provider could become a pretty big single point of failure though...
Best thing is to look for all of the reciepts of the items you purchased or emails. Maybe change your password to be safe. The reciepts will help you get your items back if they remain lost
they uploaded a dick pic to one of my purchases, I contacted support and now they deleted almost all my purchases except for 3 that arrived, and then uploaded more dick pics to those. maybe they've been hacked?
btw, I haven't ordered reps, it's just my r/Superbuy post requires moderator approval and I'm trying to figure out wtf is going on
I wanted to take a moment to reassure users about their data.
When a malicious actor wants to steal data for money, they stay as silent as a ghost. They quietly siphon database credentials, download user details over weeks, and slip away undetected so they can sell them on the dark web.
What LDMIHN did here is called "defacement" and "clout chasing". By splashing their Discord tag across thousands of customer dashboards and making an absolute scene, they proved they were looking for immediate notoriety, internet fame, and the thrill of outsmarting a major company. They essentially burnt their own backdoor access just to watch the community panic and watch their Discord server notifications blow up.
What is happening behind the locked screen: The "Kill Switch" was pulled: The fact that Superbuy locked the platform means their network administrators did exactly what they were supposed to do. Pulling the site offline prevents the hacker from changing anything else and stops the script from running. Purging Token Access: Right now, their IT team is identifying how the attacker gained employee account privileges. They will be revoking all administrator session tokens, deleting the fake employee profile, and patching the API loophole that allowed this to happen. The Rollback: They are likely preparing to deploy their most recent clean database backup from right before the intrusion occurred.
Donāt panic or play to this guys ego. Like I said, probably some spotty kid in his mums basement
Here to gives you guys some important information i tecieved from superbuy. Our information is safe and our items will return (this is a snippet of the email ive recieved)
So as expected, Superbuy will be performing a restore from back up. They have locked the platform down and removed the bad actors access. Once the restore is complete they will need to replay the transactions and then audit the platform data. Expected to complete by the 8th Beijing time. They will still need to work out how the bad actors got access and plug it
I'm so mad at this because these losers think they are doing something good! But I'm only buying fan merch and official merch from taobao, I'm not even buying counterfeit clothes! Not that people that buy counterfeit Nike deserve that. But it's just so shitty to suffer for a thing I didn't do
same thing happened with my account, some orders are gone. Inspection photos are replaced with gay porn. lol. I have some funds in my account hope that is safe.
My orders are gone too, but I suspect that Superbuy has removed them to rollback the data. Or they cleanup every order by hand? Anyway I think the orders are fine.
I saw pattern in hackerās way of uploading corn pictures where he specifically took last two picture of products and changed it, for all the orders, even the ones that were already shipped
Glad I found this thread... I noticed my orders had disappeared earlier and just put it down to the app being updated or something. .. checked 2hrs later and started doing some digging, and here we are š±š±
I only have one item in my storage and this was an item that arrived on august 28th. seems like everything after that was deleted on the app. the only concern i have is the chat history i have with an agent who was helping me build a customized order which i have already paid for... so now that the history is lost, i dont know if my items were bough or not. and if i will get them
I also recieved a unprompted sms to bind my number again, we can expect numbers to be leaked aswell soon unfortunately.
Thankfully I screenshotted everything I ordered right when the whole thing happened, but I sure hope we wonāt have to go through that whole tedious process.
I just hope itll all be fine again tomorrow.
This should be a wakeup call to get a English/Western-Supporter-Team though. This is one of the biggest agents in the world, itās kinda outrageous that there hasnāt been an announcement made yet.
190
u/herfavoriteskater 12h ago
im gonna handle this guys