Companies/Gorgias/Incidents

Gorgias: Shopify checkout hijack campaign notice

Timeline of updates

1. investigating2026-10-22 12:19 UTC

   We’re aware of a campaign targeting third-party apps on Shopify stores, where malicious code can be delivered to shoppers’ browsers through compromised app providers.
   After an initial investigation, we can confirm we have no evidence that Gorgias is affected. Our engineering team is actively monitoring the situation, and we are verifying the integrity of the scripts we serve to your storefront.
   We’ll send an update as soon as we have more information. In the meantime, we recommend reviewing the third-party apps installed on your store and checking Shopify’s guidance for any app you’re unsure about.
   If you see anything unusual related to Gorgias, contact us at support@gorgias.com.

2. monitoring2026-10-22 20:58 UTC

   Our engineering team continues to investigate the Shopify third-party app security campaign.
   At this point, we have no evidence that Gorgias has been affected. We are continuing to verify the integrity of our storefront scripts and monitor incoming customer reports.
   We will continue providing updates as our investigation progresses. If you notice any suspicious behavior related to Gorgias, please contact support@gorgias.com

3. resolved2026-10-27 15:33 UTC

   We consider this incident resolved, as we have no evidence that Gorgias has been affected.
   As part of our investigation, we:
   - Checked our storefront and checkout code (chat, self-service, Convert and our Shopify extension) for every known indicator of compromise. We found none.
   - Reviewed the last 30 days of infrastructure and CDN logs for the scripts we serve to storefronts and checkout. We found no sign of tampering or abuse.
   - Confirmed that the scripts we serve exactly match what our build pipeline produced.
   As a precaution, we're applying extra hardening measures and following Shopify's security recommendations for app partners. Our engineering team will continue to monitor the situation closely.
   We still recommend that store owners review the third-party apps installed on their store and follow Shopify's guidance for any app they're unsure about.
   If you see anything unusual related to Gorgias, contact us at support@gorgias.com.

Changes Rewindex caught on this incident

• Oct 22Incident updated: Shopify checkout hijack campaign notice
• Oct 27Incident updated: Shopify checkout hijack campaign notice

Impact, status and times are the vendor’s own, as last archived. View on status.gorgias.com (opens in new tab).

Gorgias profileRecent Gorgias incidentsAll outages on October 22, 2026Gorgias in October 2026MarkdownJSON