Articles on: Pareto - Quantity Breaks

Pareto and the October 2026 Shopify checkout hijacking incident

Pareto is not affected by the checkout hijacking incident reported between October 10 and 21, 2026, and your store's checkout stays safe with Pareto.

What happened

Starting October 10, 2026, shoppers on a number of Shopify stores were sent from the Checkout button to a fake checkout page hosted on a .top domain. The fake page collected card details, then sent shoppers back to the real Shopify checkout, so orders looked normal to the merchant.
The malicious code was not in the store's theme. It was delivered by some third-party apps through settings fields that let merchants enter custom JavaScript or HTML.
Shopify confirmed that its core checkout was not compromised. The issue came from a small number of third-party apps. App developers who have confirmed they were affected include Hulk Product Options, Selleasy and Swym Wishlist Plus (source).

Is Pareto affected?

No. Pareto is not on the list of affected apps, and the way Pareto is built means it can't be used for this kind of attack. The section below explains why.

Why Pareto is safe

No custom JavaScript fields

Pareto has no settings field where custom JavaScript can be entered. This is the biggest difference from the affected apps, which were exploited through exactly this type of field.

No theme edits or script tags

Pareto has no permission to edit your theme files or add script tags to your store. Pareto widgets only appear through Shopify's official theme app extension, which you can turn on or off in your theme editor.

Checkout stays fully on Shopify

Pareto does not change your Shopify checkout page. Discounts are applied through Shopify Functions, Shopify's native discount technology.

PHP security fix already applied

On October 21, 2026, PHP released an emergency update for two vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Shopify asked partner apps to apply it. Pareto has already applied this update, so these vulnerabilities do not affect your store.

Protected access to your store

Your Shopify access token is encrypted with AES-256 when stored.
Pareto uses expiring access tokens that refresh automatically, following the standard Shopify recently recommended for partner apps.

Certified security practices

Pareto is built by Omega, which holds a SOC 2 Type II report. Our infrastructure security includes:

AES-256 encryption at rest and TLS 1.3 encryption in transit
Continuous vulnerability monitoring
Regular penetration testing

Your data stays yours

We only collect the data the app needs to work.
We never sell or share merchant data.
We delete your data within 30 days of a request, and immediately when you uninstall the app.
Our sub-processor list and Data Processing Agreement (DPA) are available on request.

Built for Shopify

Pareto has the Built for Shopify badge, which means it meets Shopify's highest standards for performance, design and safety.
You can review all of our security practices yourself in the Omega Trust Center.

How to check your store

Use this checklist to make sure your checkout is safe, whichever apps you use.

Open a private (incognito) browser window and go from a product page to the cart, then to checkout. Check that the address bar stays on your store or Shopify checkout domain.
Close the window and repeat the test in a new private window. The malicious script only runs once per session, so one test may not be enough.
Go to Online Store > Themes > Customize > App embeds and turn off any embed you don't recognize.
List the apps on your store that have a field for custom JavaScript or HTML, and review what has been entered there.
Change your password and turn on two-factor authentication for your Shopify account and for your app vendor accounts.

If you find a redirect to an unknown domain:

Turn on store password protection to stop new shoppers from reaching checkout.
Disable the app you suspect.
Take screenshots and save the URLs as evidence.
Report the issue to Shopify Support and to the app developer.

Our commitment

We continue to monitor the situation and are applying the new app security requirements Shopify announced on October 20, 2026.
If you have any concern about your store's security, chat with us from the Pareto app and our team will help you right away.

Updated on: 22/10/2026

Was this article helpful?

Thank you!