Of all the things a Shopify merchant worries about in October, the checkout usually isn't one of them. Shopify hosts it, secures it and carries the compliance burden for it. It's the one part of the store that's officially somebody else's job, which is precisely why we love it so much.

And to be fair to Shopify, the checkout was never breached. It just turned out that, on an unknown number of stores, shoppers weren't always making it there first.

From 10 October, some shoppers who clicked Checkout were quietly sent to a lookalike payment page on an attacker's domain. It collected their card details, then politely forwarded them to the real checkout, where the order completed as normal. The shopper got their product. The merchant got their sale. The dashboard looked lovely. Everyone was happy, apart from the minor detail of a stranger now holding everyone's card number.

It wasn't caught by a monitoring system, either. It was caught by a developer whose password manager offered to autofill the wrong field on what should have been a routine purchase. An entire industry of security tooling, and the hero of the story is a mildly confused password manager. (Somewhere, an enterprise security vendor is rewriting a pitch deck.)

Here's what makes this one genuinely clever (said with the grudging respect you'd give a burglar who also tidied up).

Many storefront apps load a small script from Shopify's own servers, which then phones home to the vendor to collect its settings: which options, which colours, that sort of thing.

In the case of Hulk Product Options from HulkApps, the script itself was never touched. What changed was the settings data. Like plenty of apps, it offered merchants a "custom JavaScript" field so they could tweak behaviour. On affected stores, that field contained roughly 22.7KB of malicious code, which the app dutifully injected into the page, because that is literally what it was built to do. The code waited for a click on Checkout, cancelled the real navigation and sent the shopper somewhere else entirely.

Security people call this a client-side supply chain attack. The file came from Shopify. The request went to a vendor you'd approved. The nasty bit arrived as data, not as a file. Every link in the chain looked perfectly respectable, like a heist crew where everyone has a valid staff badge.

It was also designed to dodge the people most likely to notice. It fired only on a genuine click, so scanners crawling the site saw a clean store. It fired only once per session, so a merchant testing their checkout after a complaint would usually see the real one. Integrity checks passed because the file hadn't changed. And because orders still completed, conversion never dipped. It was, frankly, a smoother journey than plenty of legitimate checkouts manage.

It would be very convenient to blame one vendor. The evidence is being inconvenient.

Three vendors have confirmed their apps were used: HulkApps; Logbase, maker of the upsell app Selleasy; and Swym, maker of Wishlist Plus. Logbase says an internal tool was accessed on 13 October. Selleasy alone reportedly runs on more than 49,000 stores. Swym saw fresh activity on 18 October and switched off Wishlist Plus for every single merchant, which is the software equivalent of evacuating the building.

One tracker reports smaller apps being used the same way in July and September. If so, October wasn't a bolt from the blue. It was the sequel, with a bigger budget.

Nobody has published a root cause. Shared domains and identical markers point to a single operator, but nobody has confirmed it. And nobody has said how many stores or shoppers were affected. (I'm sure they'll get round to it.)

One small mercy: shoppers paying with Shop Pay, PayPal or Google Pay appear to have been largely protected, according to one analysis, because wallets never expose a card number to the page. The people at risk were the ones typing their card details in by hand, like it's 2014.

Shopify's response has been substantial. It has also been roughly as precise as a leaf blower.

Around 480 apps left the Shopify App Store in a little over a week, including well-known names like Rebuy, Privy, Bold, 17TRACK and Rokt's Aftersell and Upcart. About 41 have since come back. Shopify hasn't explained most of the removals, and the majority have no confirmed link to the hijack.

Two details matter. First, delisting an app doesn't switch it off on stores where it's already installed; it only stops new installs. So a delisted app doesn't mean you're protected, and a listed one doesn't mean you're safe. Second, the weeks before Black Friday are exactly when merchants go shopping for new promo and upsell tools. Imagine being a perfectly innocent app, pulled off the shelf in peak season for standing near the wrong guy.

On 20 October, Shopify gave every developer a week to enable two-factor authentication and short-lived access tokens, and told them to treat all storefront data as untrusted. (Excellent advice. Also a sentence that slightly undermines the whole "trusted app ecosystem" positioning.)

Most coverage has treated this as a security story with a checklist stapled to the bottom. The more useful reading is economic.

Shopify has always traded control for flexibility: merchants assemble their stores like flat-pack furniture from dozens of different suppliers. One developer's research suggests the number of apps is growing at roughly 28% a year, about twice as fast as the number of stores.

Each one is a separate company running code in your shopper's browser, with its own staff, its own internal tools and its own relationship with the password "Summer2024!". A store with 25 storefront apps effectively has 25 security perimeters it doesn't control and can't audit.

And here's the uncomfortable bit: those custom JavaScript fields exist because merchants asked for them. They're sold as flexibility. The vulnerability is the same feature, viewed from the other side.

This gets interesting for the many of us selling on both platforms. Amazon sellers have spent years envying Shopify's freedom. Amazon lets you customise roughly nothing. Nobody can inject code into a listing, and no third-party tool can touch Amazon's checkout. We usually file that under "costs of selling on Amazon". October suggests it could also be filed under "protection". Amazon's costs just show up on the fee statement, while Shopify's can stay invisible until a customer's card turns up somewhere it shouldn't. (I never expected to write a paragraph that makes Amazon's detail page sound cosy, yet here we are.)

The same week, emergency patches dropped for a critical PHP flaw (the language under WordPress, WooCommerce and Magento) that had reportedly sat undiscovered for around 14 years. Several organisations found it recently, independently, using AI models. Fourteen years of human review, and then the machines found it in a season. Anything defenders can do with AI, attackers can do too, faster and cheaper.

There's also an irony in the timing. Shopify has spent the year flinging its checkout open to AI shopping agents, most recently letting any agent that identifies itself complete purchases. Walmart announced an approved-agents-only framework the same month. Amazon still blocks third-party agents entirely, which is very on brand. October's attack targeted the moment a human clicked a button. As more purchases get initiated by software instead, the number of places a transaction can be quietly redirected only goes up.

None of this requires buying a shiny new security tool. (Apologies to everyone about to send you a cold email about one.)

Test the checkout properly. Open a fresh private window, add a product, hit Checkout and confirm the address bar stays on your domain or Shopify's checkout domain. Close it and repeat, including from the cart drawer and on mobile. Then check session storage in developer tools for anything starting with "__ctf_", a confirmed marker of this campaign.

Audit the app stack honestly. Every app with a custom JavaScript or HTML field is somewhere code can hide. Open each one and make sure you recognise everything in it. Remove any app that isn't earning its place, plus its leftover theme code. If you can't explain why an app is installed, you're trusting a supplier you're not watching.

Sort out credentials. Change your Shopify and app vendor passwords, turn on two-factor everywhere and review which collaborators still have access. If you run any of the confirmed apps, ask the vendor in writing whether your store was affected. Merchants report a vendor's reassurance alone hasn't always been enough for Shopify to clear a store to reopen, so get it on paper.

Push the wallets. Giving Shop Pay, PayPal and other wallets prominent placement this season is a conversion decision that moonlights as a security measure.

Shopify still has some big questions to answer. Will it restrict the custom code fields apps offer? That would close the route these attacks used, but also strip out flexibility a lot of merchants and agencies genuinely rely on. And who pays when a shopper's card is stolen via a fake page, reached from a merchant's store, delivered by a vendor's compromised system, on a platform that hosts both of them? Nobody has volunteered an answer, which I'm sure is just an oversight.

Underneath it all sits the bigger one. Openness has been Shopify's defining advantage over Amazon and the foundation of its agentic commerce strategy. October showed that openness and trust don't automatically come as a bundle. Whether Shopify can keep the first while rebuilding the second, before the busiest weekend of the year, is Shopify's question to answer.

What we do with our own app stacks in the meantime is ours.

Jo

P.S. If you've just opened your Shopify admin to count your apps and are now quietly closing the tab: same energy as checking your bank balance after a long weekend. Nobody's judging.

P.P.S. The fraudsters built a checkout that never lost a single sale. Some of us have spent entire quarters trying to do that legitimately. I'm not saying it stings. I'm just saying it stings.

P.P.P.S. For the record, the most effective fraud detection system in this entire saga was a password manager that got slightly confused. Give it a raise.

📖 Reconfigured - The analysts' journal for recording findings.

🔎 Zupyak - Do SEO research and create high-ranking content with AI, without using expensive agencies and contractors. Used by 400,000+ professionals.

🙋🏻‍♀️ Kraftful Surveys GPT - Create product surveys for insightful customer feedback.

🤖 Jan - An open-source chatbot that runs 100% offline on your computer and provides 10x productivity.

📸 Product Descriptions GPT - Craft engaging e-commerce product listings.

😍It was great, all I needed

🙂Good, not great

🙄It sucked