In October 2026, attackers got into three Shopify apps and used them to send shoppers from the checkout button to fake payment pages. Shopify’s own checkout wasn’t breached. The way to limit your exposure is to run fewer apps, remove what uninstalled apps left behind, know which apps can inject code, and tighten your logins.
The short version
- Between 10 and 20 October, Hulk Product Options, Selleasy and Swym Wishlist Plus were compromised.
- Code loaded through each app’s settings sent shoppers to look-alike payment pages, then on to the real checkout, so orders looked normal.
- Shopify removed the code, switched off affected features and is tightening what app code can do on storefronts.
- You can cut your own exposure in an afternoon. The checklist is below.
What happened in the October Shopify app hijack?
Attackers didn’t touch Shopify’s checkout, and they didn’t touch merchants’ themes. They used the apps themselves. Code loaded through each app’s own settings, from the app developer’s servers, and when a shopper clicked checkout it quietly sent them to a look-alike payment page. Card details went to the attackers. Then the shopper was forwarded to the real checkout and the order went through as normal.
So the merchant saw a normal order. The theme files looked clean. And because the redirect only fired once per browsing session, testing the store a second time in the same tab showed nothing wrong.
| App | Confirmed compromised |
|---|---|
| Hulk Product Options | 10 October |
| Selleasy | 13 October |
| Swym Wishlist Plus | 14 and 18 October |
No count of affected stores has been published.
What has Shopify done about it?
Shopify moved quickly once it knew. It removed the injected code, switched off affected app features and pulled apps from the App Store while developers investigated. Swym switched its app off for every merchant.
On 20 October Shopify told app developers, in a post called Securing your app, together, that it’s bringing in tighter limits on what app code can do on the storefront, along with stricter security requirements for the App Store. Dates for those haven’t been published yet.
Separately, Shopify is already retiring script tags, one of the older ways apps add code to a store. According to Shopify’s developer docs, apps can’t create or update script tags from 1 October 2026, and Shopify stops loading them on 1 March 2027. Apps that haven’t moved to newer methods will stop working on the storefront from that date.
That will help. It won’t change the basic fact that every app you install is someone else’s code running on your store, maintained by a company you’ve probably never spoken to.
How do you cut your store’s app exposure?
You don’t need an agency for this. You need an afternoon and your list of apps.
- Remove apps you don’t use. Go through every installed app and ask when it last did something you’d miss. If nobody can remember, uninstall it.
- Check what uninstalled apps left behind. Plenty of apps leave code in your theme after they’ve gone.
- Turn off app embeds you don’t recognise. In the theme editor, open the App embeds panel and switch off anything unfamiliar. Shopify’s help page on app embeds shows where to find them.
- List apps that accept custom code. Any app that lets you paste in JavaScript or HTML is a door. Know which apps have one and who in your team can open it.
- Check before installing. See whether your theme or Shopify already does the job before adding another app.
- Tighten logins. Turn on two-step authentication for every staff and collaborator account, and remove anyone who no longer needs access, including agencies you’ve stopped working with.
Why does the number of apps matter?
Every app is a company with access to your store. Some have access to customer data, some to orders, and some can load code on every page. The more apps you run, the more companies you’re relying on to keep their own security tight.
A lot of the features stores install apps for, like bundles, wishlists or product options, have native or theme-level versions now. One less app is one less company with code on your checkout. We’ve written about the Shopify apps quietly slowing stores down, and the same clean-up helps both problems.
How do you test your checkout for redirects?
Every so often, open a private browser window, add something to the basket and click checkout. Make sure you land on your own domain or Shopify’s checkout, not something else. Close the window and do it again in a fresh one, because this attack only fired once per session.
Do it on a phone as well as a laptop. Some redirects only fire on certain devices.
What should you do if you find a problem?
If you ever land somewhere unexpected:
- Screenshot everything, with the address bar visible.
- Put the store behind a password.
- Switch off the suspect app’s embed and uninstall the app.
- Contact Shopify Support and the app developer.
- Talk to your payment provider about what to tell customers.
Is there an upside?
Speed. Every app you remove is a script that no longer loads, so the clean-up that makes your store safer usually makes it quicker too. A quicker store converts more of the traffic you’re already paying for, which puts you in a better position for the busy weeks coming up.
Frequently asked questions
Was Shopify’s checkout hacked?
No. Shopify’s checkout wasn’t breached. The attack used compromised apps to send shoppers to fake payment pages before they reached the real checkout.
Which Shopify apps were compromised?
Hulk Product Options, Selleasy and Swym Wishlist Plus were confirmed. If you used any of them in October, check with the developer and Shopify Support.
How do I know if my store was affected?
Check whether you had any of the three apps installed between 10 and 20 October. Look for customer complaints about payment pages or card fraud from that period, and contact Shopify Support if you’re unsure.
What are Shopify app embeds?
App embeds are how many apps add features to your theme. You can switch them on and off per theme in the theme editor, under App embeds.
What happens to script tags in March 2027?
Shopify stops loading script tags on storefronts from 1 March 2027. Apps that still rely on them will stop working on your storefront unless they’ve moved to newer methods. Ask your app developers if they’re ready.
How we can help
Send us your list of installed apps. We’ll go through it and tell you which ones you could remove, which ones load code on your storefront, which still rely on script tags, and which ones your theme or Shopify could replace. Most stores end up with a shorter list and a faster site.
