In this article
Between October 10 and October 20, 2026, code delivered through three popular Shopify storefront apps sent some shoppers to lookalike checkout pages built to capture their card details. According to reporting by iTnews and the security firm cside, at least two of the app developers said an unauthorized party had changed what their apps loaded on some stores. The apps were pulled from the Shopify App Store while the developers cleaned up, and at least one affected store was told by Shopify to stay closed while it was investigated.
No report says Shopify’s own checkout or systems were breached. The attack ran through apps that store owners had installed, which is exactly the part of a Shopify store that belongs to you. On October 20, Shopify told developers it’s tightening the rules for storefront app code and moving apps to expiring access tokens.
Here’s how to check your store, and the settings worth reviewing either way.
Was my Shopify store affected?
If a test checkout stays on your own domain and none of your app developers has told you about a security incident this month, you’re very likely fine. The affected apps were a product options app, an upsell app and a wishlist app. If you use apps like those, check your email and each app’s status in your admin, then run a one-minute test checkout.
To test:
- Open a private browser window, on your phone and on a computer.
- Visit your store, add a product to the cart, and start checkout.
- Watch the address bar. Checkout should stay on your own domain or your
.myshopify.comaddress, inside Shopify’s checkout page. - Repeat it a few times, on both devices. Researchers who studied these attacks recommend several tries.
If checkout ever jumps to an unfamiliar domain, don’t enter card details. Take screenshots with the address bar visible, note the time, and keep reading.
What should I do if my store was hit?
Preserve evidence first, then shut off the source. Screenshot what you saw, disable or uninstall the app involved, and contact its developer in writing. Open a case with Shopify Support, and tell your payment processor, since customers may have typed card details into a fake page.
Then talk to your attorney about notification duties. If your customers include Floridians, Florida law generally requires notice within 30 days of a breach of certain personal information, including card numbers with their security codes. Keep every message with Shopify and the app developer in writing. Merchants in Shopify’s community forum reported that a developer’s word alone wasn’t always enough to get a store reopened.
What does Shopify secure, and what’s on you?
Shopify secures the platform: its servers, its checkout and its card handling. Shopify is certified PCI DSS Level 1, and it says its checkout provides compliance with the current card security standard with no extra work from merchants.
You’re responsible for everything you add or allow on top of that:
- staff accounts and their permissions
- two-step login and recovery codes
- collaborator access for agencies and freelancers
- apps, and what you’ve let each one access
- your theme code and any scripts, pixels or tags added to it
That’s where most Shopify store problems start, and it’s what the checklist below covers.
The Shopify store security checklist
1. Review staff accounts. In Settings → Users, remove anyone who no longer works with you, and give everyone else only the permissions their job needs. Shopify shows each user’s last five logins there, which is worth a glance for anything odd. Never share a login between people.
2. Require two-step authentication for everyone. Shopify requires it for stores using Shopify Payments and recommends it for every account. Store your recovery codes somewhere safe and offline.
3. Tighten collaborator access. Agencies and freelancers should use collaborator accounts, and collaborators must have two-step login on. In Settings → Users → Security, you can require a request code, so nobody gets collaborator access without your approval.
4. Audit your apps. Settings → Apps shows every installed app, what each one can access, and which haven’t been used in 30 days. Uninstall anything you don’t use. Pay close attention to apps with settings that accept custom code, such as custom JavaScript or HTML fields, since that’s how this month’s attacks delivered their code.
5. Clean up what uninstalled apps left behind. Shopify notes that removing an app may leave its code in your theme. In the theme editor, check App embeds and turn off anything you don’t recognize. A developer can search your theme files for leftover snippets.
6. Inventory your scripts before March 2027. Shopify stopped letting apps add old-style script tags to storefronts on October 1, 2026, and those script tags stop loading entirely on March 1, 2027. If your store depends on any, now is a good time to find out which, before something quietly stops working.
7. Keep your pixels and tags lean. Every tracking pixel is third-party code running on your store. Keep the ones you actually use and remove the rest.
8. Check your payout details. Confirm the bank account for your Shopify payouts is the one you set. Account takeovers sometimes change it quietly.
Should I uninstall all my apps?
No. Apps are part of what makes Shopify useful, and most are well run. The lesson from October is to keep the list short, know what each app can do, and remove anything you’ve stopped using. Fewer apps means fewer companies whose security you depend on.
A note for Tampa Bay shops
Plenty of Tampa Bay brands, from coffee roasters to boutiques, run on Shopify with years of apps installed along the way. If your store was built by someone who’s since moved on, there’s a good chance nobody has reviewed its apps, staff list or theme code in years. An afternoon with this checklist closes most of that gap.
Want a second set of eyes?
Our website security audit covers Shopify stores: staff and collaborator access, apps and their permissions, leftover theme code, scripts and pixels, and how your checkout is set up. We build and maintain Shopify stores too, through our Shopify development team. If you think your store was hit, call 813-531-9400 or see our hacked website repair page.
Common questions
Was Shopify hacked? No public source says so. The attacks ran through third-party apps installed on stores, not through Shopify’s own systems.
Is Shopify more secure than WooCommerce? Shopify takes more off your plate, because it runs the servers and checkout. You still own your accounts, apps and theme. Our WooCommerce checklist covers the other side.
How often should I run through this list? Every quarter, and any time you add an app, change developers or hear about an incident like this one.