Shopify Store Compromised? Securing Staff Accounts and Apps

Signs your Shopify account has been compromised

Common signs include:

• A new staff account, role or collaborator you did not add
• Products, prices, discount codes or gift cards created or changed overnight
• An app installed that nobody on the team recognises
• Login alerts or two-step prompts you did not trigger
• Changes to the payout bank account or to Shopify Payments details
• Customers reporting odd emails, checkout pages or payment requests that seem to come from your store

Also check your email. If the store owner's mailbox is compromised, an attacker can reset the Shopify password from there. Our guide on what to do when business email is hacked covers that side.

Shopify account hacked: first-hour steps

Work through these in order. Steps 2 to 5 are all in Settings > Users in your Shopify admin, per Shopify's managing users guide.

1. 1

   Contact Shopify Support and secure the owner login

   Use the support link inside your admin or help.shopify.com. Reset the owner password to a new, unique one, and set up two-step authentication or a passkey if it was off.

2. 2

   Suspend unknown or suspicious users

   Settings > Users > select the user > Actions > Suspend. Suspend first; you can remove permanently once you know what happened, because removal cannot be undone.

3. 3

   Revoke devices you do not recognise

   On each user's page, click Revoke Access next to any device or application you do not recognise. They will need to log in again.

4. 4

   Review collaborators and generate a new request code

   Filter Users by type Collaborators. Remove any you did not approve and generate a new collaborator request code so old codes stop working.

5. 5

   Check the user management activity log

   Settings > Users > Security > User management activity log shows when users and roles were created, edited or deleted, and by whom.

6. 6

   Check payouts, apps and recent changes

   Confirm the payout bank account in your Shopify Payments settings, review installed apps in Settings > Apps, and look for new discount codes, gift cards, staff and theme edits.

7. 7

   Tell customers if their data or payments may be affected

   If customer data was exposed, the PDPA may require notifying PDPC and affected customers. Our PDPA data breach notification guide explains the test.

Be careful who you talk to while this happens. Shopify says Support only asks for sensitive documents through a secure upload page on app.shopify.com or a shopify.com address. A 'Shopify agent' who calls you and asks for your code is a scammer.

Require two-step authentication for every Shopify user

This is the single most useful setting. Shopify's two-step authentication for users page explains that you can set each user to 'Secure sign-in method is required'. Shopify recommends this by default for new users.

• Go to Settings > Users, open each user and choose Secure sign-in method is required, then save. The user is logged out and must set it up next time.
• Each staff member manages their own method (authenticator app, security key, passkey or built-in authenticator) under their own account. You cannot see or change it for them.
• Shopify no longer lets anyone set up SMS as a new two-step method; existing SMS users can keep it, but an authenticator app or passkey is stronger.
• Ask staff to store their recovery codes somewhere safe, such as a business password manager.

Our MFA set-up guide explains which second factor to choose, and password managers for small businesses covers storing recovery codes properly.

Staff roles, collaborators and the owner account

Shopify's account security page is clear: the store owner should not share their login with anyone, including staff, and each person should have a unique staff account with specific permissions. A shared owner login means you cannot tell who did what, and one phished employee hands over everything.

Collaborators are Shopify Partners such as agencies. Shopify's collaborator accounts page notes that they can request and be given all available permissions, so give them only what the job needs. Their access expires automatically after 90 days without a login, and you cannot transfer store ownership to a collaborator.

Review apps and app permissions

Apps can read and change store data, including orders and customers. In Settings > Apps, open each app's about page to see its permission details, privacy details and billing. Uninstall anything you do not use, do not recognise or that was installed around the time of the incident.

After an incident, also check your theme for code you did not add, such as unfamiliar scripts, and look at which apps have pixel connections. If you are unsure whether a script belongs there, ask the developer who built the theme or restore a known-good theme version.

Monthly Shopify security habits

Shopify's login history guide recommends reviewing users' login histories periodically for unknown ISPs, locations or IP addresses. Each user's page shows the five most recent sessions with date, IP, ISP, location and browser.

Leavers are the most common gap. Add Shopify to your employee offboarding checklist so access ends with the job.

Do it yourself or get help?

Most owners can work through the first-hour steps and the 2-step setting in an hour. It is worth getting help if the attacker also had your email, if payout details were changed, or if you cannot tell which apps and scripts are legitimate.

Our Hacked Email Recovery service (S$290) locks the attacker out of the mailbox behind your Shopify login, removes hidden forwarding rules and reviews sign-in history. If the store itself needs rebuilding or tidying with proper staff roles, see our Shopify Store package (S$1,890).