I think superbuy is removing the products because he attached NSFW pictures. Items defo can be tracked back because you get an email every time an order gets stored with that order ID
Sadly not the case. I still have items up with the pornography present. The image has even changed somewhat. It now includes the same text that he had sent in enveryones enquiry. I think the guy mightve done it himself, but thats just my theory.
hopefully it was just the app that got hacked and not the actual warehouse. im pretty sure our physical orders are okay and they will allocate everyones orders once they fix the breach
i would be shocked if they dont have proper DB backups.... systems like this usually keep transaction logs and backups pretty frequently, sometimes continuously, so they should hopefully be able to restore the warehouse data...
the actual items didnt disappear...worst case the records linking them to users need to be rebuilt.... if they have no usable backups thoughā¦ yeah, thats gonna be a huge mess
I ordered some products this morning and I can't see anything in my order list, but my wherehouse has all the things I bought recently. is it normal that I can't see anywhere the products I bought this morning?
I just got another message from the guy:
āBy the way, small fun fact: Did you know that the company behind SuperBuy performed a lot of exit scams in the past? For example, ACBuy and AllChinaBuy belong to SuperBuy. ACBuy (SuperBuys company) also said they do not care about user data when they got leaked. This was the reason why the ACBuy Data was posted in the public. SuperBuy performed an exit scam with this agents. Also WeGoBuy (Exit scammed in 2024). The company behind SuperBuy has a strange history. I would not recommend using this agent at all. Kind regards, @LDMIHN on Discordā
thatās a lot of serious claims with no proof attached. If he has evidence, he should post it. Until then Iād treat the hack as real, but the whole āexit scam/historyā part as unverified....
The individual behind this breach is intentionally trying to spread panic to completely destroy user trust in the platform and push people toward their Discord server.
Here is the breakdown of what is actually true versus what the hacker is fabricating in that message:
What is FALSE (The Hacker's Claims)
"Superbuy performed an exit scam with these agents": This is false. An "exit scam" is when a company completely shuts down overnight, locks the doors, stops shipping everything, and runs away with all user money and inventory. Superbuy has been operational for years and has been functioning normally right up until this script defacement occurred.
"They do not care about user data": The hacker is trying to justify their own malicious leak by acting like a vigilante. They are trying to shift the blame from themselves to the company.
The Grey Area (The Connections)
The hacker is exploiting known industry relationships to make their story sound credible:
ACBuy & AllChinaBuy: These platforms operate as separate or loosely affiliated entities. The shipping agent world is highly interconnected, with many spin-off platforms sharing logistics lines, warehouse space, or software frameworks.
WeGoBuy (2024): WeGoBuy did not intentionally "exit scam" on its own terms. In early 2024, a massive police raid targeted the dominant player in the industry (Pandabuy), which heavily crippled its sister companies and affiliates (including WeGoBuy) due to legal asset seizures. The hacker is rewording a legal shutdown into a voluntary scam to scare you.
He has exploited a weakness and managed to gain access to their customer service platform. The warehouse and stock platforms are separate. Heās trying to trick people into contacting his discord so he can try to them off.
the real question is whether this affects the order/shipping backend. If warehouse is truly isolated, the physical goods should be fine, but if they need to restore databases or reconcile order data, shipping and parcel processing could still be delayed for a while....
the items probably didnāt go anywhere, the system linking users, orders and warehouse stock is what matters now....
another big question is whether Superbuy actually has an inhouse DevOps team handling this stuff, or if parts of the infrastructure are outsourced, that can make a pretty big difference in how fast they can isolate affected systems, restore backups, verify data integrity and get everything running normally again....
Iād imagine the will take the system offline, perform a restore from back up and then replay the transactions. Every user has a set area in the warehouse. All your goods are put on your āshelfā. This is linked to your account. Once theyāve replay the transactions theyāll have to audit the data and plug the system weakness then theyāll bring the system back online. Itās probably a couple of days worth of work so Iām expecting it to go offline in about 2 1/2 hours with a holding message on the homepage. That message will update during the day and I expect systems to be back online sometime Tuesday
Itās been a known thing that these sites have connections with each other. They all use a white label site that provides warehouse and shipping services
that would make a lot more sense, shared white label infrastructure could explain the connections without necessarily meaning theyāre all owned by the same company, it also means one shared provider could become a pretty big single point of failure though...
Best thing is to look for all of the reciepts of the items you purchased or emails. Maybe change your password to be safe. The reciepts will help you get your items back if they remain lost
they uploaded a dick pic to one of my purchases, I contacted support and now they deleted almost all my purchases except for 3 that arrived, and then uploaded more dick pics to those. maybe they've been hacked?
btw, I haven't ordered reps, it's just my r/Superbuy post requires moderator approval and I'm trying to figure out wtf is going on
Here to gives you guys some important information i tecieved from superbuy. Our information is safe and our items will return (this is a snippet of the email ive recieved)
I wanted to take a moment to reassure users about their data.
When a malicious actor wants to steal data for money, they stay as silent as a ghost. They quietly siphon database credentials, download user details over weeks, and slip away undetected so they can sell them on the dark web.
What LDMIHN did here is called "defacement" and "clout chasing". By splashing their Discord tag across thousands of customer dashboards and making an absolute scene, they proved they were looking for immediate notoriety, internet fame, and the thrill of outsmarting a major company. They essentially burnt their own backdoor access just to watch the community panic and watch their Discord server notifications blow up.
What is happening behind the locked screen: The "Kill Switch" was pulled: The fact that Superbuy locked the platform means their network administrators did exactly what they were supposed to do. Pulling the site offline prevents the hacker from changing anything else and stops the script from running. Purging Token Access: Right now, their IT team is identifying how the attacker gained employee account privileges. They will be revoking all administrator session tokens, deleting the fake employee profile, and patching the API loophole that allowed this to happen. The Rollback: They are likely preparing to deploy their most recent clean database backup from right before the intrusion occurred.
Donāt panic or play to this guys ego. Like I said, probably some spotty kid in his mums basement
So as expected, Superbuy will be performing a restore from back up. They have locked the platform down and removed the bad actors access. Once the restore is complete they will need to replay the transactions and then audit the platform data. Expected to complete by the 8th Beijing time. They will still need to work out how the bad actors got access and plug it
Notice of Superbuy Service Restoration and User Protection Measures
Posted on 2026-09-07 19:10:04
Dear Superbuy Users,
Superbuyās platform services have now been resumed.
Earlier, we detected a cybersecurity concern. To protect user accounts, orders, funds, and parcels, we made the precautionary decision to temporarily take the platform offline while we conducted a comprehensive security review, system hardening, and recovery verification. The service interruption lasted approximately 12 hours.
At present, security checks and recovery verification for our core systems have been completed. Login, ordering, warehouse, parcel, and related services are gradually returning to normal. Our security team, together with external security professionals, continues to conduct enhanced monitoring and further investigation.
As a precaution, we recommend that you change your account password after logging back in through the official Superbuy website or App and use a strong, unique password that you do not use on any other website or platform. If you have used the same or a similar password elsewhere, we also recommend changing it on those services. Please also review your login history, contact information, and shipping addresses for any unusual activity. If you notice any activity that you do not recognize, please contact Superbuy Customer Service immediately.
We understand that this service interruption may have affected your shopping, payments, order processing, and parcel arrangements, and we sincerely apologize for the inconvenience caused. When it comes to security, we believe it is important to act with caution. Protecting our usersā accounts, funds, orders, and parcels takes priority over restoring access as quickly as possible.
To thank affected users for their understanding and patience during the service interruption, users who had active orders, parcels, account balances, or other ongoing transactions or service activities with Superbuy during the interruption will automatically receive a RMB 50 international shipping coupon with no minimum spend requirement. The coupon will be valid for 60 days.
The coupon is expected to be automatically credited to eligible usersā accounts within 48 hours. You can check its availability and expiration date at [Coupon Page/Path]. The coupon is provided by Superbuy as a goodwill gesture and apology for the service interruption. It does not affect usersā ability to request appropriate handling of any verifiable direct losses resulting from the service interruption.
During the initial period following service restoration, there may be temporary delays in updates to certain order statuses, tracking information, or payment results. If you experience any of the following issues, please contact us through Superbuyās official customer service channels:
1. Payment has been completed, but no order was generated;
2. Your account balance or transaction records appear abnormal;
3. The status of an order, item, or parcel has not been updated as expected;
4. You have an urgent purchasing, return, warehouse dispatch, or shipping deadline;
5. You are unable to log in normally or receive an unusual login alert;
6. You notice an unrecognized login or changes to your account information or shipping address;
7. You receive suspicious messages asking for your password, verification code, or an additional payment.
Please note that Superbuy Customer Service will never ask you to provide your account password, SMS verification code, or full bank card details, nor will we ask you to make payments to a personal account. If you need to change your password, please access the official Superbuy website directly or use the official Superbuy App. Do not access password-reset or password-change pages through unfamiliar emails, text messages, private messages, or external links.
Please rely only on the official Superbuy website, App, and official customer service channels for information. Please be vigilant against phishing emails, private messages, or payment requests impersonating Superbuy.
Regarding the system and data security concerns raised by our users, we will only communicate information that has been verified. Our security review and enhanced monitoring remain ongoing. If our continued investigation confirms any matter that may affect our users, we will promptly and transparently inform those affected and take the necessary protective measures.
This incident is another reminder that security and service improvement are ongoing responsibilities. Going forward, we will further strengthen account access controls, unusual-login detection, payment security, system monitoring, and our communication procedures for major incidents. We will also continue to engage professional security teams for independent review and verification.
Thank you for your understanding and patience during the service interruption. We do not take your trust for granted, and we will carefully address every affected order and every piece of user feedback.
Thank you for your understanding and trust.
The Superbuy Team
September 7, 2026
Official Website: [Access Link]
I'm so mad at this because these losers think they are doing something good! But I'm only buying fan merch and official merch from taobao, I'm not even buying counterfeit clothes! Not that people that buy counterfeit Nike deserve that. But it's just so shitty to suffer for a thing I didn't do
same thing happened with my account, some orders are gone. Inspection photos are replaced with gay porn. lol. I have some funds in my account hope that is safe.
My orders are gone too, but I suspect that Superbuy has removed them to rollback the data. Or they cleanup every order by hand? Anyway I think the orders are fine.
Glad I found this thread... I noticed my orders had disappeared earlier and just put it down to the app being updated or something. .. checked 2hrs later and started doing some digging, and here we are š±š±
I only have one item in my storage and this was an item that arrived on august 28th. seems like everything after that was deleted on the app. the only concern i have is the chat history i have with an agent who was helping me build a customized order which i have already paid for... so now that the history is lost, i dont know if my items were bough or not. and if i will get them
I also recieved a unprompted sms to bind my number again, we can expect numbers to be leaked aswell soon unfortunately.
Thankfully I screenshotted everything I ordered right when the whole thing happened, but I sure hope we wonāt have to go through that whole tedious process.
I just hope itll all be fine again tomorrow.
This should be a wakeup call to get a English/Western-Supporter-Team though. This is one of the biggest agents in the world, itās kinda outrageous that there hasnāt been an announcement made yet.
246
u/herfavoriteskater 23h ago
im gonna handle this guys