As most of you are aware, there has been an unprecedented wave of cyberattacks across the Shopify ecosystem, with a large number of technology partners impacted and delisted. I want to take a moment to answer some questions and address some of the speculation. @RebuyEngine is one of the impacted partners. We were delisted, but thankfully not because of checkout hijacking. WHAT HAPPENED On October 14, our team noticed unusual activity on our public APIs. Attackers sent millions of requests probing them and eventually found an unprotected path to create a user account without verifying inbox ownership. Normally this wouldn’t be an issue, since accounts must be linked to a store to access anything. However, the attackers registered accounts using our company email domain and found that staff accounts were linked to our internal development stores with elevated privileges. They then used those sessions to read settings through our APIs. Most of the reads were on our internal development stores, but they did read product settings and configurations for 11 merchant stores. No edits or changes were made, only reads, and the data accessed was mostly benign, such as product settings and data source rules. Our API does not expose sensitive data such as API keys or tokens. Each affected merchant was notified within 24 hours. WHAT WE DID Our security team contained and remediated the incident within a few hours of detection. We blocked the attackers’ IP addresses, disabled the accounts and sessions involved, and closed the vulnerable path. We also removed elevated privileges from all staff accounts. These privileges are now granted only to select employees, such as Customer Success Managers, who are added to a dedicated Google Workspace group so they can support merchant accounts. We also promptly notified Shopify’s Security team. Even though we knew it would likely lead to a delisting, it was the right thing to do. WHAT WE ARE DOING Although the incident was contained and remediated within hours, we are working with a third-party security research team to verify our remediation and conduct a full penetration test of our authentication services. We will continue to work closely with Shopify’s Security team to close out the incident. Our engineering team is using Claude Mythos and other frontier models to continuously scan every surface of our application for weaknesses, including complex chained attacks. We will keep using AI to help combat AI. We are automatically enabling multi-factor authentication for all merchants to protect against weak or leaked credentials, and we’ll continue releasing security updates across the platform, including additional MFA methods and identity provider (IdP) support. WHERE WE GO FROM HERE Rebuy continues to function as expected for existing merchants. We remain hyper-vigilant and hope to be back on the App Store soon. We are committed to continuing to build the most powerful and secure personalization platform in ecommerce. If you have questions or concerns, feel free to DM me, comment, or email me.