Incident disclosure: protecting our merchants and their customers

We recently identified and responded to an incident involving unauthorized access to certain merchant information. Our team patched the identified vulnerability, and our defenses were blocking subsequent attempts to exploit it.

The incident did not involve malware. It did not involve phishing and was separate from the phishing attacks reported elsewhere in the Shopify ecosystem.

How we’re protecting merchants

Protecting our merchants and their customers is our number one priority. As part of Rokt, Aftersell is backed by a security team led by former FBI personnel and ongoing investment in advanced security capabilities, including Rokt’s is enrollment in Anthropic's Cyber Verification Program, which gives vetted security teams access to Anthropic's most capable models for defensive security work.

That expertise supported our response. We’re building on that work with additional security reviews and independent third-party testing to further strengthen protection for our merchants and their customers.

Our app is temporarily unavailable on the Shopify App Store while we complete the security review and remediation process with Shopify.

What our investigation found

Our investigation to date indicates that the information accessed included certain merchant upsell configurations, staff email addresses and discount codes for a small subset of merchants. No shoppers’ personally identifiable information was compromised.

Reinstalling Aftersell

Aftersell merchants do not need to take any action, the app remains fully functional.

Merchants can still reinstall Aftersell while it’s temporarily unavailable on the Shopify App Store. In your Shopify admin, go to Settings > Apps, open the Uninstalled tab, and reinstall Aftersell. You’ll be asked to approve an “unreviewed app,” which appears because of the temporary delisting.

Our commitment

Merchants trust us with their businesses, and protecting that trust guides our response. We’ll continue to strengthen our defenses and keep merchants informed. We also want to extend our support and security expertise to other apps affected by attacks, helping protect merchants and their customers across the Shopify ecosystem.

We’ll continue to update this page as we work toward being relisted on the Shopify App Store.