A German software engineer, Roman Zipp, discovered a cyberattack while buying from a Shopify-powered store, according to Adweek. During checkout, he noticed the site redirected to a domain unaffiliated with either Shopify or the merchant. Further inspection showed the redirect led to a fake checkout page, likely designed to steal personal information from customers.
The vulnerability did not originate from Shopify’s core platform, but rather from a third-party extension installed via the Shopify App Store. These extensions are commonly used by merchants to add features such as recommendation engines or upsell screens. The incident points to the security risks posed by external integrations, which can create new entry points for attackers.
For regulated businesses, the event shows the need to scrutinise third-party digital tools, especially those handling payments or customer data. Financial and insurance firms using ecommerce or digital platforms should assess the security of all external applications, not just core systems.
The incident may prompt further checks by digital and risk leaders, as well as questions about the vetting process for third-party apps in major ecommerce marketplaces.
