OnePlus has announced that up to 40,000 customers were affected by the security breach that caused the company shut down credit card payments for its online store earlier this week.

The information is the result of an ongoing investigation with a third-party security agency into the breach that caused customers’ credit card information to be stolen while they were purchasing OnePlus products. Though reports of stolen credit card information and fraudulent purchases were only made in the past week, OnePlus says that the script that stole the data had been running on one of its payment processing servers since mid-November. 

OnePlus, a major Chinese smartphone manufacturer, has gotten itself into a hell of a lot of security trouble lately, and now the situation is only getting worse.

Mobile security researcher Robert Baptiste, who goes by the pseudonym Elliot Alderson (a nod to the main character in the Mr. Robot series), discovered that OnePlus smartphones have been apparently shipping for years with a hidden backdoor. It makes it easy for a clever hacker with physical access to root a OnePlus phone with just a few lines of code. Alderson found an application on OnePlus devices intended for factory testing, and discovered it could be used to obtain “root access” to the phone.