On October 14, 2026, between approximately 10:06 UTC and 11:56 UTC, an unauthorized party made a change to our Swym Wishlist Plus app configuration that caused a script to load on certain pages across a limited subset of storefronts using the app.
Mitigation fixes to contain the harmful effects of the script were progressively rolled out starting at 15:02 UTC. During that window, shoppers who clicked the checkout button on affected pages may have been redirected to an external website designed to imitate a checkout page and collect payment card details. All fixes were fully deployed by 16:32 UTC.
The underlying configuration change has been reverted, the affected access channel has been secured with multiple protective layers, and the script has been completely removed from all storefronts.
Swym does not collect, process, or store payment card information in any of its features, and we have found no evidence that merchant accounts or data stored by Swym were accessed. Our investigation remains ongoing.
To fully resolve the issue, secure our infrastructure, and protect customer storefronts, our engineering team executed the following containment and security measures:
Identified and removed the malicious code injection on the storefront and verified that it is no longer being served.
Strengthened system boundaries by restricting endpoints matching the attack pattern and adding an additional layer of authentication.
Proactively rotated API secrets and internal access credentials to invalidate potential unauthorized access.
Implemented enhanced client-side and server-side sanitization rules to block future code injection attempts.
With the script removed and baseline functionality restored, our team is executing additional proactive security upgrades across our infrastructure. These steps are intended to strengthen protection against similar attacks and support long-term resilience.
No action is required on your Wishlist Plus app settings. As a precaution, we verified the configuration on every installation and rotated the service credentials involved.
If you observed unexpected checkout behavior on your storefront between 10:06 UTC and 16:32 UTC on October 14, 2026, or if a shopper has reported being redirected, please contact us at support@getswym.com so we can review it with you.
You may have your own obligations to notify shoppers or regulators, for example under state breach-notification laws, data protection laws such as GDPR, or your agreement with your payment processor. Please check these with your advisors.
Maintaining a secure, dependable platform is fundamental to our business and the trust you place in Swym. We sincerely appreciate your patience, cooperation, and partnership as we execute our immediate response and continue making ongoing investments to fortify our infrastructure against evolving threats.
Helping e-commerce brands craft a more seamless experience for their customers
