# October 2026 Shopify Checkout Security Incident

> Attackers used compromised third-party Shopify apps to send shoppers to a fake checkout and steal card details. What happened, what Shopify did and what to do now.

- Author: Ismail Namdar, Founder at Palmiyes
- Co-author: Selim Namdar, Shopify Engineer at Palmiyes
- Published: Nov 13, 2026
- Reading time: 4 min
- URL: https://www.palmiyes.com/blogs/shopify-checkout-security-incident-october-2026
- Tags: Shopify security incident, Shopify checkout, Fake checkout, Payment skimming, Shopify apps, App audit, HulkApps, Selleasy, Swym Wishlist Plus, checkout.liquid, Checkout extensibility

Around 10th of October, a couple of Shopify Apps developed by different parties (not Shopify) were targeted for a cyber attack on their internal services. Through different methods, attackers were able to inject malicious code to a couple of Shopify apps services that redirected customers to attackers’ fake checkout page where they were able to collect payment information including credit card details from the customers. Attackers used different methods to hide their fake checkout page to prevent being caught.

![How the attack redirected customers to a fake checkout](https://www.palmiyes.com/_next/static/media/checkout-security-incident-diagram.a55abce3.png)

## What Shopify did?

- Stopped the effected apps after it was reported.
- Developed a tool for app developers to do a security check in their app with a command.
- Unlisted ~500 apps from the Shopify app store.
- Brought stricter security measures to all apps.
- Now asks customers for confirmation before redirecting them from checkout to another page.

### What you need to do?

Although there are recommendations online around what to do here, we believe this needs to be strengthened more by Shopify and Shopify app developers. Shopify already took precautions around this to make sure Shopify app developers are writing the app with the highest security standards. Audit the apps in your store and remove the ones that are not in use. Pick the apps carefully if the app has access to critical parts of your store including checkout, orders and account pages.

Although it is not essential, it is always recommended to use security companies to do an audit on your store every 6 to 12 months.

## Effected reported apps

- HulkApps (Hulk Product Options)
- Selleasy
- Swym Wishlist Plus

We see more and more security incidents across the industry this year and not just in ecommerce. We believe this is because AI made it easier to find security issues compared to before since now you can have 100s of agents searching for vulnerabilities in your app and store. This is why it is better to count on Shopify which has 1000s of specialists working for you.

Shopify already made the decision to remove **checkout.liquid** long time ago and moved to **Checkout extensibility** to overcome these types of security problems for their merchants. Although it made it harder to change checkout, we can see why it was essential today and we believe it will be bulletproof over time even with external apps.