Earlier this month, a wave of compromised Shopify apps started sending shoppers to fake checkout pages. A small number of the stores we look after were among those affected. We’ve written this up because the lessons apply to almost every Shopify brand, and because Black Friday is five weeks away.
We’ve made the same case to clients for years: every app added to a store costs something. It slows pages down, adds bugs and creates maintenance that rarely shows up in the monthly fee. This month added another cost to the list. Every app on your storefront runs code that someone else controls, and when that someone else is hacked, your customers see the result.
The short version
- Shopify’s own checkout wasn’t hacked. The attack ran on the storefront, one click before checkout, through third-party apps.
- Three app developers have confirmed that attackers used their apps: HulkApps (Hulk Product Options), Logbase (Selleasy) and Swym (Wishlist Plus).
- Orders looked normal, so most merchants had no idea unless a customer told them.
- The fewer apps you run, the fewer third parties you have to trust.
What happened
On 10th Oct, developer Roman Zipp clicked Checkout on a keyboard retailer’s Shopify store and landed on a convincing copy of Shopify’s checkout. His password manager noticed the unfamiliar web address before he did. His investigation traced the problem to an app whose settings are loaded from the developer’s own servers on every page view.
The fake page collected the shopper’s card details, then passed them on to the real checkout, where they paid as normal. The order went through and the script only fired once per visit, so the merchant saw nothing unusual. In one case reported by iTnews, the retailer only found out because a customer screenshotted the page and emailed her.
The three developers above have each confirmed that unauthorised code went out through their apps between 10th and 18th Oct. Swym has since paused its app for every merchant. None of them has published a full explanation of how attackers got in, and nobody yet knows how many shoppers entered card details.
Where things stand (23rd Oct)
More than 400 apps have left the Shopify App Store since mid-October. Most of these removals aren’t linked to the attack. Some are precautionary, and some are routine, because Shopify delists apps that miss API deadlines and one passed on 16th Oct. A missing listing isn’t evidence that an app was compromised, and it doesn’t remove the app from stores that already have it installed.
The picture is still changing. New fake checkout domains were reported as recently as 21st Oct, and a few merchants have reported redirects without running any of the apps named so far. So treat the confirmed list as a starting point, not the full story.
On Shopify’s side, it has removed affected apps from the App Store, asked developers to contact merchants directly and released a new security check for app developers to run before they ship.
Why we push for fewer apps
Most stores we review carry more apps than they need. Some were installed for a test two years ago, some were added by a previous agency, and some duplicate something the theme already does. Each one costs you in four ways.
Speed. Most apps load their own code, and many load it on every page whether it’s needed there or not. That code competes with your product images and add to cart button, and on mobile the delay adds up quickly.
Bugs. Apps are built separately and updated on their own schedules, then expected to work smoothly inside your theme and alongside each other. Often they don’t. Two apps fighting over the cart drawer, a pop-up covering the buy button on mobile or a discount that stops working after an update are some of the most common problems we fix. More apps means more combinations that can break, and longer to find the cause.
Maintenance. Each app is another set of updates to track, another login to secure and another subscription to justify. Many leave code behind when you uninstall them. Shopify’s platform changes add to the workload too. That’s time your team or your agency spends keeping things running rather than improving the store.
Security. This attack didn’t need to touch your theme or Shopify itself. It came in through app settings, controlled by the developers. Every app with access to your storefront is another third party you’re relying on.
The obvious objection is that apps make money. Upsells, bundles and wishlists earn their keep, and nobody wants to rebuild everything from scratch. That’s fair, which is why our test is whether an app is essential, not whether it’s useful. A lot of what brands install apps for, such as bundles, product recommendations in the cart and simple product options, Shopify now handles natively. The apps that genuinely earn a place, such as subscriptions, reviews and search on a large catalogue, should each have a named owner on your team, with any custom code settings left empty unless you’re using them.
A lean store won’t be immune to problems. It will be faster, break less often and cost less to run, and when something does go wrong there are fewer places to look.
Where this goes next
Shopify has spent several years taking third-party code away from checkout. The old checkout.liquid customisations have gone, the Additional Scripts box stopped running on every plan by August 2026, and Shopify Scripts stopped in June 2026.
The storefront is next. Apps haven’t been able to add new script tags since 1st Oct, and Shopify stops loading them altogether on 1st March 2027. From 1st Jan 2027, all public apps must also use access tokens that expire. We expect Shopify to keep tightening what apps can do on the storefront, and the brands that have already cut back will feel those changes least.
What to do this week
- Test your checkout like a shopper. Open a private browser window, add a product to your cart and press your normal Checkout button. As checkout loads, the address bar should show your own domain or your myshopify.com address. Repeat from the cart drawer and on your phone, using a fresh private window each time.
- List every app and who owns it. You’ll find them under Settings, then Apps. If nobody can explain why an app is there, flag it.
- Ask your developer or agency to check app embeds and custom code settings. Anything that loads on every page, or holds code nobody recognises, should be reviewed.
- Chase any app that has been delisted. Ask the developer in writing whether your store was affected and when.
- If something looks wrong, screenshot the page with the address visible, switch the app off, then contact Shopify Support and your payment provider.
Before Black Friday (27th Nov)
- Remove what isn’t essential, and have a developer clear any code those apps leave behind.
- Tighten access. Turn on two-step authentication for everyone who logs in, and remove old staff or agency access you no longer need.
- Brief your customer service team. A customer mentioning an odd-looking payment page should be treated as urgent, not as a glitch.
Into 2027
- Make an app review a quarterly habit. Ask three questions each time: do we still use it, can it run custom code, and could the theme do this job itself?
- Get ahead of March. Make sure every remaining storefront app is ready for the script tag change well before the deadline.
If you’d like a second pair of eyes on your app stack before peak, take a look at our work and get in touch. As a Shopify Premier Partner, keeping on top of platform changes like this is a big part of what we do, and you’ll find more in our insights.