We identified the activity immediately and made the difficult decision to pause the app for all merchants at once, stopping it from spreading to any further stores. This gives us time to investigate fully and add further layers of security before we restore access. We will continue to provide regular updates.
Based on our investigation to date, we have found no evidence indicating that any merchant data or customer personal information has been compromised through the Swym Wishlist Plus application. For stores where the malicious code was deployed, customer data may have been compromised if shoppers visited the external site and entered their details manually.
We continue to monitor our systems closely and will updates at status.getswym.com as our investigations continue.
This page will be regularly updated and provides the information we have available at this time, including answers to the most common questions and the steps we are taking.
For further information, please [email protected] .
Over the past week, unauthorized activity was detected by our team, which affected some merchant stores.
For those impacted, attempts were made to add malicious code to the Swym Wishlist Plus application with the intention to redirect shoppers away from your ecommerce store.
We have disabled the app for all our merchants in response as a precautionary measure. We are investigating how this happened and will continue to provide regular updates.
How do I know if my store is impacted?
All impacted stores are being contacted directly by Swym.
Has my data, or my customers personal data been compromised?
Based on our investigation to date, we have found no evidence indicating that any merchant data or customers personal information has been compromised within the Swym Wishlist Plus app. We continue to monitor our systems closely and will updates should any new information emerge.
For stores where the malicious code was deployed, customer data may have been compromised if shoppers visited the external site and entered their details manually.
Has the app been paused only for impacted stores?
Why does the Swym app not open in my Shopify admin?
We revoked Shopify access for Swym Wishlist Plus and all other Swym apps on purpose, as a precaution. This has been done for all merchants whether they were impacted or not. We will provide a timeline for restoring access in due course.
The wishlist icon or button still shows on my store. Does it work?
No. The wishlist icons, buttons and Swym app embeds may still show, but they do not work while the app is paused. If you use the Swym API on a headless site or mobile app, you may see errors.
If you would like to hide the buttons and icons, you can turn them off by following these steps:
In your Shopify admin, open Online Store > Themes. Then click Customize on your live theme.
In your Shopify admin, open Online Store > Themes. Then click Customize on your live theme.
Turn off the Swym embeds (App Control Center and Storefront UI Elements), then click Save.
Turn off the Swym embeds (App Control Center and Storefront UI Elements), then click Save.
Turn them back on when we tell you the app is restored.
Turn them back on when we tell you the app is restored.
Why did my wishlist or alert emails stop?
These emails depend on Swym's connection to your store, which is paused. We will provide a timeline for restoring access in due course, at which point the emails will resume.
Your store and your customers
I haven’t been contacted, can I personally check whether my store has been impacted?
Our support staff have contacted all impacted stores, however, you can confirm this yourself by doing the following:
Open Online Store > Themes in your Shopify admin
Open Online Store > Themes in your Shopify admin
Click Edit code on your live theme
Click Edit code on your live theme
Look for any theme file edits that show as made by the Swym app, and all theme files for checkout-guard (the malicious domain).
Look for any theme file edits that show as made by the Swym app, and all theme files for checkout-guard (the malicious domain).
Shopify keeps older versions of each theme file. If you find edits made by our app that you do not recognize, or the malicious domain, check with your developer, test your store, and revert those files to the version before the change.
Exactly when was my store impacted?
On Oct 14th, 2026, between 10:06 UTC and 11:56:00 UTC, an unauthorized script was loaded onto a limited subset of storefronts due to a configuration change.
The exact sequence of events is as follows:
10:06:00 – 11:56:00 UTC: An unauthorized party made a change to our Swym Wishlist Plus app configuration that caused a script to load on certain pages across a limited subset of storefronts using the app
10:06:00 – 11:56:00 UTC: An unauthorized party made a change to our Swym Wishlist Plus app configuration that caused a script to load on certain pages across a limited subset of storefronts using the app
13:30:00 UTC: Initial detection following a merchant inquiry reporting unauthorized code execution.
13:30:00 UTC: Initial detection following a merchant inquiry reporting unauthorized code execution.
14:20:00 – 14:30:00 UTC: Credential rotation was initiated and completed across all application microservices to halt the active exploit.
14:20:00 – 14:30:00 UTC: Credential rotation was initiated and completed across all application microservices to halt the active exploit.
16:32:00 UTC: Deployment of application code fixes was completed, effectively securing the storefronts.
16:32:00 UTC: Deployment of application code fixes was completed, effectively securing the storefronts.
23:58:00 UTC: Administrative cleanup and sanitation of storefront configuration records completed across affected stores.
23:58:00 UTC: Administrative cleanup and sanitation of storefront configuration records completed across affected stores.
Which pages did the script run on?
The script loaded on storefront pages where the Wishlist Plus embed was active and rendered, primarily collection, product, and cart pages. The unauthorized code did not run passively on page load; it attached an event listener to checkout buttons and triggered only upon interaction when a shopper clicked checkout. Based on our investigation to date, the script did not read, capture, or harvest form field values or input data entered on your genuine storefront or Shopify checkout pages.
Were my customers or their payment details impacted?
Based on our investigation to date, we have found no evidence indicating that any merchant data or customers personal information has been compromised within the Swym Wishlist Plus app.
However, if your store was impacted and customers were redirected to an external checkout page and entered their details manually, their data may have been compromised.
If shoppers confirm they were sent to another website from your store, please report that to our support team immediately, with the page and the time.
What happens to my wishlist data?
Pausing the app's access does not delete any wishlist data stored by Swym. Once we restore the app’s access, this data will be available to customers and merchants again.
Is it safe to leave the Swym Wishlist Plus app installed?
Yes. While access is paused, the app cannot use its Shopify access to read or change your store.
Have you rotated your Shopify app credentials?
We have revoked the app's Shopify credentials, so no existing access token for your store works.
We have also rotated all app credentials and only the new credentials will take effect when the app is reenabled.
Do I need to change my Shopify password or staff accounts?
Based on what our investigation has uncovered so far, the activity used the app's access, not your staff accounts. Changing passwords is still good practice, and we recommend turning on two-factor authentication.
Can you the malicious domains so we can monitor for them?
Yes. The malicious domain that our investigations have uncovered is: checkout-guard[.]top (written with [.] so it cannot be clicked).
We have also seen these domains in similar attacks in the broader Shopify ecosystem recently: account-confirm[.]top, billing-confirm[.]top, and checkout-secure[.]top. Please block or monitor all of them. If you find any of them in your theme files, check with your developer and test before you remove them. We will add to this list if we find more such domains.
Is there anything else I should look out for?
Yes. If shoppers tell you they were sent to another website from your store, please report that to our support team immediately, with the page and the time.
How do I Swym?
Email [email protected] .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
