The Fallout of Infected Shopify Apps
Shopify’s reliance on third-party plugins has led to years of data breaches. Learn why an all-in-one platform like Merchant Tech keeps your store secure.
By Alex Hansen ·
On this page
Shopify Checkouts Are Being Hijacked
Since early October, several popular Shopify apps have been used to load malicious code onto merchants’ storefronts. When shoppers navigated to checkout, they were redirected to a convincing fake checkout page that captured their card and billing details, then sent them back to the real checkout so the purchase would go through as normal. Neither the shopper nor the merchant had reason to notice.
Merchants are being advised to disable as many apps as they can, run a test checkout in an incognito window to make sure it loads the real Shopify checkout, and change the passwords for both their Shopify account and any app accounts.
A Track Record of Third-Party Breaches
Shopify has a history of compromises involving themes, apps, or plugins, all of which are typically authored by third parties (not you, not Shopify, but rather a different company). Just this year, there was a huge checkout hijacking vulnerability. Customers browsing to your online storefront could have their money stolen at no fault of your own. And customers would blame your brand for it!
In 2024, a third party plugin developer left their database unencrypted, and 1,800 Shopify stores were compromised. 7.6 million customer order records were stolen in this leak.
In 2023, storefronts were compromised via a third party “countdown timer” widget. In 2022, an inventory plugin was compromised and gave attackers unfettered access to all of a merchant’s data and records. In 2021, a product review app was compromised and millions of customer email records were stolen.
Why Shopify Can’t Escape the Plugin Problem
I could keep going. The moral of the story is: Shopify is only a good fit for your business if you do not care about the security of your data and customers’ data. A system which allows third party authors to publish plugins inherently means the surface area for attacks is significantly larger.
This is unfortunate, because Shopify as a platform has extremely limited functionality. You are essentially required to use plugins, themes, and apps to accomplish basic tasks. Without them, Shopify’s value proposition is severely diminished.
As a small business owner and operator of an e-commerce retail company, I prefer to spend my time running the day-to-day of my business. In my case, this means selling watches and watch tools. I do not want to think about the cybersecurity vulnerabilities that my e-commerce platform might expose me to. In my case, I was using Shopify.
A Complete Platform, Built In
This is one of the multiple reasons I founded Merchant Tech. I do not want merchants on our platform to have to think about the tech backing our product. I don’t want our customers to have to become experts in cybersecurity to use our product. To be honest, I want our merchants to barely know we exist. Our merchants are able to focus on the one thing that they should be focusing on: running their actual business.
Instead of shipping an incomplete platform and relying on third party authors to finish the job, Merchant Tech offers you a complete platform with everything built-in. For illustrative example: Shopify doesn’t natively support product reviews, so they rely on third party developers to write that code for them. I guess Shopify has a shortage of software developers or something.
We will also build your website for you, or migrate your website from Shopify/WooCommerce/whatever, for free. Yes, that sounds crazy. But that’s how serious I am about treating our merchants well. When you’re part of our team, we invest a ton of time into ensuring your store is as good as it can be. Optimized SEO, good mobile compatibility, good analytics, customer data…all of it. For one flat price of $79/mo – no additional plugin charges, nothing. Just $79/mo.
No platform with a third party plugin system will ever be truly secure. Keep that in mind as you decide whether or not to start, or keep, your business with Shopify. Choose Merchant Tech instead, and let us handle all the pain for you.
Founder and CEO of Merchant Tech.
