Australian retailer stays closed after Shopify checkout redirection attack

Australian dog harness retailer WAGD remains shut following a 13 October attack that diverted a customer to a fraudulent checkout, with owner Carly Clarke saying Shopify has advised her not to resume trading.

Clarke said she immediately closed the website and notified Shopify after a customer supplied screenshots and the suspicious address. Shopify support asked her to maintain password protection while its investigation continued, without giving a reopening date.

Clarke said the advice remained in place despite the app developer confirming it had removed the malicious code and Shopify verifying its removal. She had not yet worked out the financial losses.

Logbase, the developer behind the Selleasy upsell app, confirmed WAGD was affected. It said an intruder accessed an internal tool and inserted a malicious script into settings for several stores, but did not disclose how many.

The company said it had locked the compromised setting, strengthened authentication and engaged an external security firm. Logbase could not rule out customers submitting information to the fraudulent page, saying it could not determine what details, if any, had been entered.

Another developer, HulkApps, disclosed a similar incident involving its Hulk Product Options theme extension. It said Shopify temporarily disabled the extension during code removal, and that it had strengthened authentication and appointed outside investigators.

Developer Roman Zipp documented code in the HulkApps incident that intercepted checkout clicks and redirected shoppers to imitation payment pages. He found it was designed to activate once per browser session before allowing subsequent visits to reach the legitimate checkout.