October 2026 Shopify Checkout Security Incident
Attackers used compromised third-party Shopify apps to send shoppers to a fake checkout and steal card details. What happened, what Shopify did and what to do now.
Around 10th of October, a couple of Shopify Apps developed by different parties (not Shopify) were targeted for a cyber attack on their internal services. Through different methods, attackers were able to inject malicious code to a couple of Shopify apps services that redirected customers to attackers’ fake checkout page where they were able to collect payment information including credit card details from the customers. Attackers used different methods to hide their fake checkout page to prevent being caught.
How the attack redirected customers to a fake checkoutWhat Shopify did?
- Stopped the effected apps after it was reported.
- Developed a tool for app developers to do a security check in their app with a command.
- Unlisted ~500 apps from the Shopify app store.
- Brought stricter security measures to all apps.
- Now asks customers for confirmation before redirecting them from checkout to another page.
What you need to do?
Although there are recommendations online around what to do here, we believe this needs to be strengthened more by Shopify and Shopify app developers. Shopify already took precautions around this to make sure Shopify app developers are writing the app with the highest security standards. Audit the apps in your store and remove the ones that are not in use. Pick the apps carefully if the app has access to critical parts of your store including checkout, orders and account pages.
Although it is not essential, it is always recommended to use security companies to do an audit on your store every 6 to 12 months.
Effected reported apps
- HulkApps (Hulk Product Options)
- Selleasy
- Swym Wishlist Plus
We see more and more security incidents across the industry this year and not just in ecommerce. We believe this is because AI made it easier to find security issues compared to before since now you can have 100s of agents searching for vulnerabilities in your app and store. This is why it is better to count on Shopify which has 1000s of specialists working for you.
Shopify already made the decision to remove checkout.liquid long time ago and moved to Checkout extensibility to overcome these types of security problems for their merchants. Although it made it harder to change checkout, we can see why it was essential today and we believe it will be bulletproof over time even with external apps.
Tags
- Shopify security incident
- Shopify checkout
- Fake checkout
- Payment skimming
- Shopify apps
- App audit
- HulkApps
- Selleasy
- Swym Wishlist Plus
- checkout.liquid
- Checkout extensibility
Written by
Ismail Namdar
Founder at Palmiyes
Ismail leads every project from the first call through architecture and launch ensuring quality at every step.
More about Ismail
Co-author
Selim Namdar
Shopify Engineer at Palmiyes
Selim works across themes, custom apps and integrations, and owns the detail that keeps a store fast: clean Liquid, careful data flows, and code that everyone can read.
More about Selim