After the e-commerce platform breach: customers keep asking "Was that you calling?" Four things brands should do in the next three weeks

In early October, an e-commerce platform's order database was hacked. According to the platform's announcement at the end of October, about 1,329 brands and roughly 4.8 million consumers were affected. The leaked data included names, phone numbers, addresses, email addresses, and order histories. Credit card details and login passwords were not affected.

What happened next is something many brands have been dealing with for weeks:

Scammers are usingreal names, real products, and real amountsto call and email your customers, claiming an order was set up incorrectly, that a refund is due, or that they need to use an ATM or add a LINE account. Customers can't tell what's real, because every detail the caller gives is accurate.

So customers start asking you: "Was that you calling?"

You didn't build the system, and you didn't do anything wrong. But in your customers' eyes, it's your store that had the problem.

This guide is for brands in that position. Four things, in order of urgency.

1. Start by announcing "what we will never do"

What customers need most isn't an apology. It's a standard they can check against.

Instead of writing "please beware of scams," list the things youneverdo:

• We will never ask you to use an ATM or online banking to "cancel a setting"
• We will never contact you from an unfamiliar LINE account
• We will never ask for your card number or verification code over the phone
• To check an order, log in through our website or app

When customers get a suspicious call, they can check it against this list. Send it once each by text, email, LINE broadcast, and website notice, with identical wording.

A common mistake: including a "click here to check" link in the notice. That's the scammers' favorite trick, and putting a link in your own notice makes it even harder for customers to tell the difference. Just ask customers to open your website or app themselves.

2. Give customer service one consistent script

For the next few weeks, customer service will be flooded with the same question. The most dangerous situation is every agent answering differently. Customers will use what agent A said to challenge agent B.

Write a response template first, and have everyone follow it:

1. We don't contact customers this way (refer to the list above)
2. Please don't follow any instructions to transfer money
3. If you've already transferred money, call the 165 anti-fraud hotline immediately and give us your order number

If you have (or plan to use) AI customer service

These weeks are when AI customer service helps the most: the same question asked dozens of times a day is exactly what it's best at. But the anti-fraud piece has to be set up right. Three key points:

• Put the template into its knowledge base, so it answers with your official wording instead of improvising.
• AI shouldn't pretend it can judge whether a particular message is a scam. It can only state your rules; the judgment belongs to a person.
• If a customer says they've already sent money, hand off to a human immediately, and remind the customer to call 165.

And keep in mind that the anti-fraud need is temporary. Day to day, AI customer service handles shipping, returns and exchanges, and product specs, the questions that repeat every day. It will still have work once this wave passes, so there's no need to set up a separate system just for fraud.

3. Take stock of how many companies hold your customer data

This breach didn't hit the brands' own systems. It hit a third party they use. And most brands, asked "which companies hold your customer data?", can't answer.

Grab a sheet of paper and list them:

A common finding: a form from a campaign two years ago still holds thousands of phone numbers; an email tool you no longer use still has a list that was never deleted.

If you no longer need it, delete it. What isn't in the database can't be stolen.

4. Should you leave the platform? Don't rush

Someone will definitely tell you to move in the coming weeks. Our advice: don't move everything at once.

The problem with e-commerce platforms isn't that they don't work hard on security. It's thatthousands of brands share the same system and the same database. One attack hits everyone at once. Switching to another big platform doesn't change that structure.

What actually changes the structure is "a system of your own": your own database, so another company's breach doesn't affect you, storing only what's needed for shipping, with addresses masked after delivery. But that takes time and budget, and not every store needs it.

A more practical approach is to move one small piece first. Flows like repeat orders from loyal customers, pre-orders, and group buys are well suited to moving to LINE ordering, while your main site stays as it is. Once that runs smoothly, decide on the next step.

We won't claim that the systems we build are "safer." Any system can be breached, and anyone who guarantees no leaks isn't being honest. We can guarantee only two things: if something happens, only your business is affected, and very little data gets out.

If you need help

Satsuma Creative can help with two things:

• E-commerce AI customer service: connected to your LINE, Instagram, or website, answering shipping, returns, and product questions from your own data. Anti-fraud handling is built in: when a customer asks "Was that you calling?", it answers with your official wording and hands off to a human if anything doesn't match. No need to switch e-commerce platforms.
• Free customer data health check: 30 minutes to fill out the table above together, without touching any customer data.

Full details atE-commerce AI customer service。

Incident figures in this article are drawn from the platform's October 2026 announcement and news reports; official announcements and regulators' statements take precedence for details.