Explore this post with:
Was Shopify hacked? There is no public evidence that Shopify's own platform, servers or payment systems were breached. Between October 10 and 14, 2026, attackers got into a small number of third party Shopify apps and used them to load a script that sent some shoppers to fake checkout pages. Shoppers who typed a card number on those fake pages may have had their card details stolen. Shoppers who paid with Shop Pay, PayPal, Google Pay or a similar wallet were not exposed.
Here is how it was first discovered. On October 10, a developer in Germany was buying a keyboard from a Shopify store. He clicked the checkout, and his password manager offered to fill the name from his credit card into a "First name" box on a page whose address ended in .top. A real Shopify checkout never lives on a domain like that. He took screenshots, contacted the store, the app developer and Shopify, and reported the domain to Germany's federal cybersecurity agency. Shopify fixed that store's checkout the same afternoon.
What he found was the first public sign of a checkout hijack that hit Shopify stores over the next four days.
What Happened in the Shopify Checkout Hijack
Many Shopify apps add features to your storefront through theme app extensions, also called app embeds. These extensions load JavaScript on every page. Some of them also pull extra code or settings from the app developer's own servers each time a page loads.
That second step is where the attackers got in. They did not touch Shopify's checkout. They changed what a few apps were sending to stores.
How the script worked
The researcher who found the attack published a technical breakdown. In the Hulk Product Options case, the app's script loaded from Shopify's own content network, which is normal. It then fetched a block of custom code, about 22.7 KB, from the app developer's servers and ran it. That block had been replaced with attack code containing a function named hijack and a list of phishing domains.
Here is what a shopper experienced:
- They browsed the store normally and clicked checkout.
- The script sent them to a lookalike payment page on biliing[.]top or one of two similar .top domains built to look like order confirmation pages.
- The page asked for card details and sent whatever was typed to the attackers.
- The shopper was then forwarded to the store's real Shopify checkout, where the order went through normally.
Because the real order was completed, neither the shopper nor the merchant had a reason to suspect anything. The script also saved a marker in the browser's session storage, under a key starting with __ctf_shim, so it fired only once per session. Merchants who tested their own checkout afterward often saw nothing wrong.
When the researcher first checked, the phishing domains were not on Google Safe Browsing or URLhaus, so most browsers showed no warning. Spamhaus had listed some of them by October 15.
Timeline of the Attack
- October 10: The redirect is discovered and reported. Shopify fixes the first affected store's checkout that afternoon and temporarily disables the Hulk Product Options theme extension while the code is removed.
- October 13, 07:47 to 15:00 UTC: A malicious script runs through Selleasy. Shopify confirms by email at 15:40 UTC that all code delivered through the app has been removed.
- October 14, 10:06 to 16:32 UTC: A further exposure window, listed in Shopify's notice to affected merchants.
- October 15: The researcher reports hearing from at least seven affected merchants, not all of whom had HulkApps installed. Hulk Product Options, Selleasy and Swym Wishlist Plus are no longer listed in the Shopify App Store.
- October 16: An Australian store owner tells reporters Shopify asked her to keep her store's password page on, with no reopening date, while the investigation continues.
What Shopify and the App Developers Have Said
Shopify has not published a public statement as of October 16, and it did not respond to press requests for comment. It has not said how many stores were affected. Its actions so far: fixing affected checkouts, disabling the Hulk Product Options extension, confirming removal of the Selleasy code, emailing affected merchants with the exposure window, and asking at least one store to stay closed.
HulkApps said an exploit on October 10 introduced unauthorized configurations into Hulk Product Options and affected only that app's theme extension. It found no evidence that its other apps delivered the redirect. It removed the code, tightened authentication and hired an independent security firm. It has not explained how the configuration was changed.
Logbase, the maker of Selleasy, said an unauthorized party gained access to one of its internal tools and added a script to store settings. It removed the script, restored merchants' overwritten custom JavaScript, locked that setting, reported the incident to Shopify and authorities, and hired a third party auditor. It said it found no evidence that its own systems were breached, but it can't know what shoppers typed on a page outside its systems. Selleasy has more than 49,000 active stores. That is its total user base, not the number affected.
Swym has not publicly confirmed that Wishlist Plus was involved. Merchants named it in reports.
Which Customers Were at Risk?
Only customers who typed a credit or debit card number during an attack window, on a store running an affected app. The redirect also didn't fire for every visitor, because some browsers blocked it.
How the shopper paid |
Card details exposed? |
Why |
|
Typed card number |
Possibly |
The fake page captured what was typed |
|
Shop Pay |
No |
Card details are stored, not typed |
|
PayPal |
No |
Payment happens inside PayPal |
|
Apple Pay or Google Pay |
No |
The wallet sends a token, not the card number |
|
Redirected, then left |
No card data |
Name, email or address may have been entered |
What This Attack Was Not
Searches for "Shopify hacked" also pull up two older, unrelated problems. Neither is part of this incident.
- Fake Shopify emails. Scam emails pretending to be from Shopify, asking you to "update payment details" through a link on an unrelated domain, have circulated for years. They are phishing aimed at merchants, not proof of a Shopify breach.
- Card testing bots. Bots that flood a checkout with small failed payments are testing stolen cards. They create junk abandoned checkouts but don't redirect real shoppers.
How to Check if Your Store Was Affected
Store Security Checklist
Check your inbox and Shopify admin for a notice from Shopify.
Review your apps under Settings, then Apps and sales channels. Look for Hulk Product Options, Selleasy or Swym Wishlist Plus at any point in October.
Check App embeds in the theme editor. Turn off what you don't use, look in theme.liquid for script tags you don't recognize, and review any custom JavaScript fields inside your apps.
Run an incognito checkout test. Add a product and click checkout. The address bar should show your domain or a shopify.com address. Use a fresh window each time, and check session storage for a key starting with __ctf_shim.
Pull orders and abandoned checkouts from the windows. In US Eastern time: October 13, 3:47 am to 11:00 am, and October 14, 6:06 am to 12:32 pm. Note which were paid by typed card.
Reset access. Change your Shopify and app passwords, turn on two step verification, and remove staff accounts and AI tools with store access you don't need.
Report the fake domains to Google Safe Browsing so browsers start warning shoppers.
What to Tell Your Customers
Contact affected customers quickly and plainly. Shopify's advice is for them to contact their card issuer and monitor their statements. You can adapt this:
Subject: A security issue affecting your recent checkout
Hi [First name], on [date] attackers misused a third party app on our store, and some shoppers were sent to a fake payment page before our real checkout. You paid by card during that window, so your card details may have been exposed. Please call the number on the back of your card and watch your statements. Your order is safe, and we've removed the app. Reply with any questions and I'll answer personally.
[Your name]
Many US states and Canadian provinces have customer notification rules after a data incident, so check with your lawyer about what applies to you.
How to Keep App Scripts Away From Your Checkout
- Run fewer apps. Every embed is code you don't control, and some fetch new code from their developer's servers on every page load. Remove apps you haven't used in 90 days, along with their leftover code. Your pages get faster too, which is the same work behind our Shopify speed optimization.
- Limit who can edit your theme and app settings.
- Put wallets up front. Customers who paid with Shop Pay, PayPal or Apple Pay were never exposed. Show those buttons in the cart.
- Test checkout monthly in a fresh incognito window, and after every app install or update.
How Proactivo Commerce Helps
An attack like this needs three things done fast: checking every installed app and theme file, finding the orders placed in the exposure windows, and setting up regular checks so it doesn't happen quietly again. That's work our Shopify experts do for store owners every week.
Proactivo Commerce is an official Shopify Partner that has worked with US brands for 6 years, delivering 500+ Shopify projects for 400+ DTC brands with 400+ five star reviews. See our work or hear it from our clients.
Check Your Store Before Your Customers Do
This attack didn't break Shopify. It came in through apps that stores trust every day, and it stayed quiet because orders still went through. The fix is plain work: fewer apps, regular checks, and someone who knows where to look.
Not sure whether your store was affected? On a free discovery call, we'll go through your installed apps, app embeds and checkout path with you, before Black Friday traffic arrives.
Frequently Asked Questions
Latest insights View all →
Rebuilding a Fashion Storefront on Shopify
How Proactivo restructured navigation, product pages and checkout for a growing apparel brand.
READ CASE STUDY
