As most of you are aware, there has been an unprecedented wave of cyberattacks across the Shopify ecosystem, with a large number of technology partners impacted and delisted.
I want to take a moment to answer some questions and address some of the speculation. @RebuyEngine is one of the impacted partners. We were delisted, but thankfully not because of checkout hijacking.
WHAT HAPPENED
On October 14, our team noticed unusual activity on our public APIs. Attackers sent millions of requests probing them and eventually found an unprotected path to create a user account without verifying inbox ownership. Normally this wouldn’t be an issue, since accounts must be linked to a store to access anything. However, the attackers registered accounts using our company email domain and found that staff accounts were linked to our internal development stores with elevated privileges.
They then used those sessions to read settings through our APIs. Most of the reads were on our internal development stores, but they did read product settings and configurations for 11 merchant stores. No edits or changes were made, only reads, and the data accessed was mostly benign, such as product settings and data source rules. Our API does not expose sensitive data such as API keys or tokens. Each affected merchant was notified within 24 hours.
WHAT WE DID
Our security team contained and remediated the incident within a few hours of detection. We blocked the attackers’ IP addresses, disabled the accounts and sessions involved, and closed the vulnerable path. We also removed elevated privileges from all staff accounts. These privileges are now granted only to select employees, such as Customer Success Managers, who are added to a dedicated Google Workspace group so they can support merchant accounts.
We also promptly notified Shopify’s Security team. Even though we knew it would likely lead to a delisting, it was the right thing to do.
WHAT WE ARE DOING
Although the incident was contained and remediated within hours, we are working with a third-party security research team to verify our remediation and conduct a full penetration test of our authentication services. We will continue to work closely with Shopify’s Security team to close out the incident.
Our engineering team is using Claude Mythos and other frontier models to continuously scan every surface of our application for weaknesses, including complex chained attacks. We will keep using AI to help combat AI.
We are automatically enabling multi-factor authentication for all merchants to protect against weak or leaked credentials, and we’ll continue releasing security updates across the platform, including additional MFA methods and identity provider (IdP) support.
WHERE WE GO FROM HERE
Rebuy continues to function as expected for existing merchants. We remain hyper-vigilant and hope to be back on the App Store soon. We are committed to continuing to build the most powerful and secure personalization platform in ecommerce.
If you have questions or concerns, feel free to DM me, comment, or email me.
2
4
345
James Van Erck retweeted
The Rebuy & @Klaviyo Integration just got a MAJOR upgrade 📣
Brands can now add existing @Klaviyo Segments to Data Source rules to recommend hyper-personalized products to customers 🎉
💡Learn how to add @Klaviyo Segments to Rebuy Data Sources: hubs.li/Q02YdtBW0
1
5
205
James Van Erck retweeted
To fully take advantage of the opportunity you currently have in getting customers to make an impulse buy, it is recommended to offer customized upsells where these buying decisions are happening (cart page and checkout page)
For this, I recommend REBUY apps.shopify.com/rebuy
2
3
7
James Van Erck retweeted
They're not psychics, but they are 98% accurate. @sickweather does population health forecasting to predict when you could get sick #Batch19
7
10
The Top UX Elements to Optimize Your Product Page — shopify.com/partners/blog/61…
37 Tactics I used to grow my company to $50k/month in sales without spending a penny on marketing. : Entrepreneur reddit.com/r/Entrepreneur/co…
1
I entered to win a dropshipping business from @Shopify goo.gl/UZ0Yg1
2
Great write-up on @mvmtwatches and @AboveMarketTeam …
Learn from the Shopify Experts Who Won Build A Business shopify.com/partners/blog/18…
1
Beer and Michael Jackson made out of post-it notes... awesome! #ModernTimes #phramed phramed.com/3ub
The Ultimate Guide To iPhone Resolutions
Great article on iPhone resolutions! paintcodeapp.com/news/ultima…
Nothing like crawling through mud, jumping into big pits of water, runni... #phramed phramed.com/2yd
