Delisted doesn't mean hacked: a calm 10-minute app check for Shopify merchants

If your feeds have been full of "delisted" and "checkout hijack" this past week, I get it. I've worked in the Shopify ecosystem for four and a half years, and this has been a stressful week for a lot of merchants and app developers.

So let's slow down together. Here's what happened, what the words actually mean, and a check you can do in about ten minutes with a coffee in hand.

What happened, in plain words

Between October 10 and 14, 2026, attackers pushed malicious code through some third-party apps' own servers or settings. On affected stores, some shoppers were redirected to fake checkout pages that collected their card details. Shopify's own checkout was not shown to be breached (iTnews).

Three vendors have publicly confirmed what happened on their side, and I think they deserve credit for being open about it (statements collected by Roman Zipp):

• HulkApps said "unauthorised configurations altered the Hulk Product Options theme extension." Shopify temporarily disabled that extension.
• Logbase, the team behind Selleasy, said "An unauthorized party gained access to an internal Selleasy tool." The window they gave was October 13, 07:47 to 15:00 UTC.
• Swym reported an unauthorized configuration change to Wishlist Plus on October 14, then paused the app for all merchants on October 20. If you use it, their incident FAQ is worth reading.

One detail explains a lot of the confusion. The redirect could fire once per browser session, so store owners who tested their own checkout again and again often couldn't reproduce it. If you clicked through your store and everything looked fine, you're in good company, but that test alone doesn't settle it.

Swym also notes that wallet payments like Shop Pay and PayPal weren't affected the same way (Swym FAQ).

Delisted, disabled, compromised: three different things

After the incident, Shopify started removing apps. Shopify told iTnews on October 17: "When an app falls short, we act... They include delisting an app to protect merchant security." Revenue Shield's tracker counts 135 apps removed from the App Store between October 14 and 20, and for most of them no reason has been given. A second count comes from heyapps.dev, a site that archives App Store listings: it counts about 430 apps delisted since October 14, 2026, and most have no public reason given.

That's why an app showing up on a list is no proof it was hacked. Apps come off the App Store for lots of reasons, and many have nothing to do with security. Many Shopify apps are built by small teams who care a great deal about their merchants, and plenty of them are having a rough week too.

Here's how I'd keep the three words apart:

• Delisted: the app is off the App Store, so new stores can't install it. According to Revenue Shield, a delisted app generally keeps running on stores that already have it.
• Disabled or paused: the vendor has switched the app off, or Shopify has switched off a piece of it, like the Hulk theme extension. Swym pausing Wishlist Plus is this kind of step. A feature on your store stops working for a while, and it's done to protect you.
• Compromised: the vendor has confirmed that someone unauthorized got in and changed what the app does. The three cases above are the ones vendors have confirmed.

So if one of your apps was delisted, give it a proper look, then carry on with your day.

The 10-minute check

You don't need a developer for any of this. Open your Shopify admin and go step by step.

Want a quick head start? Our free delisted app checker looks at the apps loading on your storefront and tells you if any of them are off the App Store right now.

1. List every app you pay for. Settings > Apps and sales channels shows what's installed, and your billing page shows what's charging you. Put the two side by side. It's common to spot an app you'd forgotten about.
2. Remove anything you don't use, along with its leftovers. Uninstalling doesn't always clean everything up. Open your theme editor, look under App embeds, and switch off any embed from an app you've removed. If an app added code to your theme files, ask the developer or whoever built your theme to tidy up what's left.
3. Review each app's permissions. Each app's page in your admin shows what data it can access. Ask yourself whether it makes sense for what the app does. If something doesn't add up, ask the vendor to explain.
4. Check custom JavaScript fields in app settings. Plenty of apps have a box for custom scripts. Open each one. If you find code you didn't add and don't recognize, screenshot it and ask the vendor what it is before you delete anything.
5. Check the vendor's status page. If there isn't one, look for an incident page, a changelog or a recent support email. Swym's FAQ is a good example of clear communication.
6. Test checkout in a fresh private window, watching the address bar. Open a private or incognito window, visit your store the way a shopper would, add something to the cart and go to checkout. Keep your eyes on the address bar the whole way. If it jumps to a domain you don't recognize, stop, don't type any card details, and take a screenshot. Because the redirect could fire just once per session, close the window and try a fresh one a couple of times.

For most stores, this ends with "all clear" and maybe one or two apps you're happy to be rid of.

If you think you were hit

Take a breath. You can work through this calmly, one step at a time.

• Ask the vendor, in writing, for your store's exposure window. You want the exact dates and times that apply to your store. Email gives you a record you'll be glad to have later.
• Contact Shopify Support. Tell them what you saw and which app you suspect, and include your screenshots.
• Change passwords and turn on two-step login. Do it for your Shopify account and your staff accounts, and for any app vendor dashboards you log into.
• Warn customers who typed card details during that window. Keep it short and honest: what happened, when, and that they should keep an eye on their statements and contact their bank if anything looks wrong. A straight, early message is kinder than silence.
• Check your local breach-notification rules. What you're required to do depends on where your business and your customers are. This isn't legal advice, so if you're unsure, talk to a lawyer or your local data protection authority.

App developers are tightening things up too

On October 20, 2026, Shopify emailed app developers a note titled "Securing your app, together" (Shopify also posted it on its developer forum). It asked them to scan their apps for vulnerabilities, move to expiring access tokens and turn on two-step login, and it said Shopify will raise App Store security requirements.

Fewer apps, fewer places for bad code to hide

Every app you install is one more piece of code you're trusting. Most of that trust is well placed. Still, the fewer apps you run, the fewer places bad code has to hide and the less you have to check next time something like this happens.

Step one of any app audit is knowing exactly what you pay for, and that's where AppTrim can save you some digging. AppTrim reads your Shopify billing invoice, lists every app charge, and flags apps that do the same job. If you'd like a fast start on the check above, try AppTrim on the Shopify App Store.

Whatever you find, go easy on yourself and on the developers. We're all working through this one together.