E-Store's Oct 16 final report says an attacker exploited a vulnerability in an application on its ShopServe servers from May 21 to Aug 1, 2026, ran a malicious program and sent database contents out. About 23,356,000 people across 7,858 current and former shops are affected: buyer names, addresses, phones, emails and employers; member IDs with encrypted passwords (E-Store judges recovery unlikely); merchant admin login IDs and passwords; and affiliate emails and passwords. About 2,096,900 records include cardholder name, first six and last four digits and expiry, but not full numbers or CVV. Forensics found no other entry path or backdoor, and E-Store says it found no sign of the data on the dark web. It added two-factor or two-step login to admin screens. Parent BASE says its own services run on separate systems and weren't affected.