--- title: "When an app you installed phishes your own customers" source: https://www.storeconnect.com/articles/news/when-an-app-you-installed-phishes-your-own-customers type: article format: markdown site: StoreConnect — Customer Commerce built natively on Salesforce site_index: https://storeconnect.com/llms.txt docs_index: https://support.storeconnect.com/llms.txt note: Append .md to any page or article URL on this site to get its Markdown form. --- # When an app you installed phishes your own customers Your checkout is only as safe as the least-secure app running on it WAGD wasn't alone. Between October 10 and October 18, attackers changed what three popular Shopify apps loaded onto merchants' storefronts: Hulk Product Options, Selleasy and Swym Wishlist Plus. Some shoppers who clicked Checkout were sent to lookalike pages that captured their card details.[^letsmetrix] None of the reports point to a flaw in Shopify's own checkout. The weak point sat one layer out, in third-party code merchants had trusted to run on their storefronts.[^flagship] That's the part every merchant should sit with, on any platform. The apps were someone else's code, but the customers, the closed store and the lost sales belonged to the merchant.[^onlinestorecoach] **[See our security certifications in the Trust Center](https://trust.storeconnect.com){:target="_blank"}** · **[Book a demo](https://storeconnect.com/book-demo)** ## Why this matters now Third-party risk is no longer an edge case. It's now close to half of all breaches, and it's the most expensive kind. | Figure | What it means for a merchant | | --- | --- | | 48% | Share of confirmed breaches involving a third party in 2026, up from 30% a year earlier[^verizon] | | $4.99M | Global average cost of a data breach, a record high; the US average is $11.5M[^ibm] | | +$227,250 | Extra cost added to a breach when it starts with a partner or supply chain compromise, the largest of 30 cost factors IBM measured[^cycode] | | 60%+ | Share of consumers likely to stop shopping with a retailer after a breach of customer data[^cyberint] | | 49,000+ | Active stores Logbase says use Selleasy, just one of the affected apps[^itnews] | {: .stat-table} ## Your store can go dark for days because of code you never wrote WAGD closed the moment its owner saw the screenshots, and it stayed closed. Even after the app developer said the malicious code was gone and Shopify had verified its removal, she was still advised not to trade, with no timeframe given.[^itnews] She got the all-clear to reopen on October 19, six days after the attack. She still hadn't worked out what those days cost her. The merchant did nothing wrong. She installed a popular, approved app to show upsell offers. The attacker never touched her store directly; they broke into an internal tool at the app maker and used it to add a script to the settings of a number of stores at once.[^itnews] One compromise upstream, many storefronts down at the same time. The fewer outside vendors that can change what your storefront loads, the fewer upstream break-ins that can close your doors. With StoreConnect, everyday merchandising like product options and cross-sell and upsell offers is part of the platform rather than an add-on from a separate developer, set up as records in the Salesforce org you already govern. There's no third company holding a settings panel that writes code into your checkout. ## Your customers will blame you, not the app developer Shoppers don't know which app rendered your checkout button. They know whose store they were on. In one retail survey, over 60% of consumers said they were likely to stop shopping with a retailer after reading about a breach of customer data, and 27% said very likely.[^cyberint] The October attack made that harder to manage, because no one could say exactly who was exposed. Logbase said shoppers may have entered details on the fake page, but since that page sat outside its systems, it had no knowledge of what was handed over.[^itnews] Swym gave a similar warning to its merchants.[^techhelp] The script was also built to fire only once per browser session before letting the shopper through to the genuine checkout, so most people would never notice a thing. When customers trust you with a payment, you need to be the one who can answer their questions. On StoreConnect, card details are typed into a form supplied by your payment provider, and StoreConnect never collects or stores the full card number.[^sc-payments] Because every order already lives in Salesforce, you can see who bought what and when, and reach those customers from the same system your service team works in. ## Every app you install is another company holding keys to your checkout The three affected apps were each compromised a different way. At Selleasy, an outsider got into an internal tool. At Hulk Product Options, unauthorized configuration changes reached the app's theme extension.[^zipp] At Swym, a later wave on October 18 used the app's own storefront access to add scripts, so Swym switched the app off for every merchant and revoked its Shopify credentials.[^fudge] Three companies, three separate security postures, and every one of them could change what a merchant's shoppers saw at checkout. Shopify responded by disabling and delisting affected apps, and on October 20 it told app developers to harden their apps and added a warning before shoppers leave a store for an outside site.[^paperblog] A Shopify spokesperson also noted that merchants stay in control of the apps on their store and can review each app's activity and permissions.[^itnews] That's reasonable advice, and it also puts the job of vetting every vendor's security back on the merchant. No platform makes third-party code risk-free, and StoreConnect stores can still add tools like analytics or live chat when they choose to. The difference is how many vendors you need in the first place and who decides what runs. Core commerce features come with the platform, and any script you do add is a record in your own Salesforce org, created by someone whose permission set allows it. StoreConnect ships role-based permission sets so a content editor, for example, can't touch payments or configuration.[^sc-users] ## You may not be able to prove what ran on your payment page Since March 31, 2025, PCI DSS 4.0.1 has required merchants to keep an inventory of every script on their payment pages, authorize each one, protect its integrity and get alerted to unauthorized changes, under requirements 6.4.3 and 11.6.1.[^cside-pci] The October attack shows how hard that is when the code comes from someone else's server. In the Hulk Product Options case, the app file served from Shopify's CDN was unchanged; the redirect arrived through a custom JavaScript setting pulled from the app maker's own servers.[^cside-hulk] The fake payment domains weren't on common blocklists either. That kind of breach also lingers. IBM found supply chain compromises took 258 days on average to identify and contain, longer than the 247-day average for all breaches.[^reflectiz] Every one of those days is a day your checkout may be quietly working for someone else. For your technical and compliance team, the question is simple: who can change the storefront, and is there a record of it? In StoreConnect, storefront edits made through the Website Builder or a connected AI agent are staged, and a person has to approve and publish them before visitors see anything.[^sc-updates] Direct record edits skip that step but are typically limited to admins through Salesforce permissions. Custom scripts are Salesforce records too, so you can report on exactly what's installed rather than reconstructing it after an incident. ## When something breaks, you're waiting on other people's investigations During the incident, WAGD's owner said she'd received more information from individual app developers than from Shopify itself.[^itnews] Logbase hired an outside security firm, and its incident report goes to Shopify. Swym paused Wishlist Plus for all merchants with no restore date given.[^paperblog] The merchant, whose store is the one that's closed, sits at the end of a chain of companies each investigating their own piece. That's the hidden cost of a stack assembled from many vendors. When it fails, accountability is split as many ways as the stack is. StoreConnect is one vendor for the commerce layer, running inside the Salesforce platform you already trust with your customer data. Our security posture is independently audited and published: SOC 2 Type I and Type II, SOC 3, ISO 27001:2022, PCI DSS 4.0.1, HIPAA and GDPR, all documented in our [Trust Center](https://trust.storeconnect.com){:target="_blank"}. And when you need help, you talk to our team directly. As Arnaud Charlier, then Head of Data and Platforms Performance at CARE Australia, put it: "StoreConnect has a support team and they will help you with any issues, questions or challenges. The team was remarkable." ## Where the risk sits, side by side No commerce platform can promise zero risk from third-party code. What differs is how many outside doors exist and who controls them. Here's how the conditions the October attack relied on compare. | What the attack relied on | Shopify stores with the affected apps | StoreConnect | | --- | --- | --- | | Everyday features supplied by separate app makers | Product options, upsells and wishlists came from three different third-party developers | Product variants and cross-sell and upsell offers are built into the platform | | A vendor's own tools or settings changing many storefronts at once | Attackers used app-side tools and configuration to add scripts across stores | Scripts are records in your own Salesforce org, added by users whose permission sets allow it | | Changes going live with no one signing off | Injected scripts ran as soon as the apps delivered them | Website Builder and AI agent edits are staged and need human approval before they publish | | Answers spread across several companies | The merchant heard from app developers and the platform separately | One vendor for the commerce layer, with a direct support team | {: .compare-table} Shopify's own checkout was not reported as compromised, and Shopify has since moved to tighten app security. The point isn't that one platform is careless. It's that every app is a dependency you're trusting with your customers, and fewer dependencies means fewer places for this to start. ## Don't wait for a customer's screenshot to find out WAGD's owner called herself lucky, because a suspicious customer tipped her off. The next merchant may not get that warning. Before peak season, it's worth asking how many outside companies can change what your shoppers see at checkout, and how you'd know if one of them did. **[See our security certifications in the Trust Center](https://trust.storeconnect.com){:target="_blank"}**. Review StoreConnect's independently audited certifications and security documentation, ready to hand to your IT, security or compliance lead. **[Book a demo](https://storeconnect.com/book-demo)**. Walk through how StoreConnect runs your storefront, checkout and orders inside Salesforce, and see the approval workflow and permission model for yourself. ## References [^letsmetrix]: "Shopify checkout hijacking (October 2026): affected apps, timeline and what merchants should check," LetsMetrix. [letsmetrix.com](https://letsmetrix.com/blogs/shopify-checkout-hijacking-october-2026){:target="_blank"} [^flagship]: "Shopify checkout redirects via third-party apps: what merchants should check now," Flagship. [flagship.inc](https://flagship.inc/en/columns/shopify-checkout-redirect-third-party-app-security){:target="_blank"} [^onlinestorecoach]: "Shopify apps breach exposes card data at checkout," OnlineStoreCoach.com. [onlinestorecoach.com](https://www.onlinestorecoach.com/news/shopify-apps-leak-card-data-at-checkout/r/recu4Z91tN2sVt510){:target="_blank"} [^verizon]: "New Verizon report reveals the security gap attackers are exploiting most," TechRepublic, reporting on the Verizon 2026 Data Breach Investigations Report. [techrepublic.com](https://www.techrepublic.com/de/article/news-verizon-dbir-vulnerability-exploitation-2026/){:target="_blank"} [^ibm]: "IBM 2026 Cost of a Data Breach Report: key findings," eSecurity Planet, reporting on IBM and Ponemon's Cost of a Data Breach Report 2026. [esecurityplanet.com](https://www.esecurityplanet.com/cybersecurity/ibm-2026-cost-of-a-data-breach-report-key-findings/){:target="_blank"} [^cycode]: "What the IBM 2026 Cost of a Data Breach Report means for product security: 5 takeaways," Cycode. [cycode.com](https://cycode.com/blog/ibm-cost-of-data-breach-2026/){:target="_blank"} [^cyberint]: "Security matters: consumer views on cybersecurity in retail and finance 2024," Cyberint. [cyberint.com](https://cyberint.com/wp-content/uploads/2024/02/Cyberint_Retail__Finance_Consumer_Survey.pdf){:target="_blank"} [^itnews]: "Shopify tells Australian store to stay shut after hijacked extensions divert shoppers," iTnews (Juha Saarinen), October 16, 2026, updated October 19. [itnews.com.au](https://www.itnews.com.au/news/shopify-tells-australian-store-to-stay-shut-after-hijacked-extensions-divert-shoppers-629693){:target="_blank"} [^techhelp]: "Compromised Shopify apps sent shoppers to fake checkout pages," techhelp.ca. [techhelp.ca](https://techhelp.ca/shopify-app-checkout-hijack/){:target="_blank"} [^sc-payments]: "Credit card payment providers," StoreConnect Support. [support.storeconnect.com](https://support.storeconnect.com/articles/credit-card-payment-providers){:target="_blank"} [^zipp]: "Shopify shops hit with ongoing checkout hijack attack," Roman Zipp. [romanzipp.com](https://romanzipp.com/blog/shopify-hit-with-phishing-attack){:target="_blank"} [^fudge]: "Shopify updates October 2026: what actually matters for merchants," Fudge. [fudge.ai](https://www.fudge.ai/blog/shopify-updates-october-2026/){:target="_blank"} [^paperblog]: "Shopify app checkout hijack: what store owners should check now," Paperblog. [paperblog.com](https://en.paperblog.com/shopify-app-checkout-hijack-what-store-owners-should-check-now-8126108/amp){:target="_blank"} [^sc-users]: "User management," StoreConnect Support. [support.storeconnect.com](https://support.storeconnect.com/articles/user-management){:target="_blank"} [^cside-pci]: "PCI DSS requirement 11.6.1 explained," cside. [cside.com](https://cside.com/blog/pci-11-6-1){:target="_blank"} [^cside-hulk]: "The HulkApps checkout hijack: how trusted Shopify apps became a phishing funnel," cside. [cside.com](https://cside.com/blog/hulkapps-shopify-checkout-hijack){:target="_blank"} [^reflectiz]: "IBM report 2026: the $227K supply-chain penalty starts on your website," Reflectiz. [reflectiz.com](https://www.reflectiz.com/blog/ibm-cost-of-a-data-breach-report-2026/){:target="_blank"} [^sc-updates]: "Manage site updates," StoreConnect Support. [support.storeconnect.com](https://support.storeconnect.com/articles/manage-site-updates){:target="_blank"} --- ## Follow StoreConnect - [Email Newsletter](https://storeconnect.com/c/lp-newsletter) - [LinkedIn Newsletter](https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7444956928444862464) - [YouTube](https://www.youtube.com/channel/UCngKdP2x8l1wcbAKW3tvU8g) - [LinkedIn](https://www.linkedin.com/company/storeconnect) - [X / Twitter](https://x.com/storeconnecthq) ## Popular Links - [Partners](https://storeconnect.com/partners) - [Become a Partner](https://storeconnect.com/become-a-partner) - [News](https://storeconnect.com/articles/news) - [Events](https://storeconnect.com/articles/events) - [Feature Comparison](https://storeconnect.com/how-we-compare) - [Download a free trial](https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FMkeKUAT) - [Book a Demo](https://storeconnect.com/contact) ## Documentation - [Help documentation](https://support.storeconnect.com/help-documentation) - [Videos & tutorials](https://support.storeconnect.com/videos-tutorials) - [Developer reference](https://support.storeconnect.com/developer-reference) - [Release notes](https://support.storeconnect.com/release-notes) - [Troubleshooting](https://support.storeconnect.com/troubleshooting) - [Trust Center](https://trust.getstoreconnect.com/) - [Status Page](https://status.storeconnect.com/) ## Contact - info@getstoreconnect.com - US +1 415 745 3230 - AUS +61 2 8365 2308 100 S Ashley Dr, Suite 600-2461 Tampa FL 33602-600 USA Level 22, Sydney Place 180 George Street Sydney, NSW, 2000, AUS ## Machine-readable - [Site index for agents](https://storeconnect.com/llms.txt): curated map of this site in llms.txt format - [Documentation index for agents](https://support.storeconnect.com/llms.txt): full technical and product documentation map Every page and article on this site has a Markdown rendering: append `.md` to its URL. Continue in Markdown: [Home](https://storeconnect.com/home.md) · [How we compare](https://storeconnect.com/how-we-compare.md) · [Partners](https://storeconnect.com/partners.md) · [Become a partner](https://storeconnect.com/become-a-partner.md) --- StoreConnect — https://www.storeconnect.com/articles/news/when-an-app-you-installed-phishes-your-own-customers