On October 18, 2026, we were notified of unauthorized activity affecting some merchant stores. As a precaution, we paused the app's access to Shopify for all merchants. This page answers the most common questions.
We were notified of unauthorized activity, starting October 18, 2026 at 21:17 UTC, that used the Swym Wishlist Plus app's access to some merchant stores. In the affected cases, scripts were added that tried to redirect shoppers away from the store. We have disabled the app for all our merchants as a precautionary measure. We will keep you updated while we investigate.
No. We paused the app for every merchant at the same time, as a precaution.
No. Based on what we know so far, the activity used the app's access, not your staff accounts.
These emails depend on Swym's connection to your store, which is paused. They resume after we restore access.
We paused Swym Wishlist Plus's access to Shopify on purpose, for all merchants at the same time. The app does not open until we restore access.
No. The wishlist icons, buttons and Swym app embeds may still show, but they do not work while the app is paused. If you use the Swym API on a headless site or mobile app, you may see errors. We recommend turning them off for now
In your Shopify admin, open Online Store > Themes, then Customize on your live theme.
Open App embeds.
Turn off the Swym embeds (App Control Centre and Storefront UI Elements), then click Save.
Turn them back on when we tell you the app is restored.
We are confirming the list of affected stores. If your store was affected, we will contact you directly. You can also check your store now, using the steps below.
We are confirming the list of affected stores and will then inform you if you were impacted.
We need to confirm the details about the incident and the stores that were impacted. Our investigation is in progress.
We cannot confirm or deny any impact on your customers yet. Our investigation is not concluded, and we will get back to you as soon as we have more information.
Pausing the app's access does not delete any wishlist data stored by Swym.
Yes. While access is paused, the app cannot use its Shopify access to read or change your store.
We have revoked the app's Shopify credentials, so no existing access token for your store works.
We do not know yet whether your store was impacted. Based on what we know so far, the activity used the app's access, not your staff accounts. Changing passwords is still good practice, and we recommend turning on two-step authentication.
We do not know yet whether your store was affected. If you would like to check, open Online Store > Themes in your Shopify admin, then Edit code on your live theme. Look for any theme file edits that show as made by the Swym app, and search all theme files for checkout-guard (the malicious domain).
Shopify keeps older versions of each theme file. If you find edits made by our app that you do not recognize, or the malicious domain, check with your developer, test your store, and revert those files to the version before the change.
Yes. This is the malicious domain we know of so far: checkout-guard[.]top (written with [.] so it cannot be clicked). We have also seen these domains in similar attacks in the Shopify ecosystem recently: account-confirm[.]top and checkout-secure[.]top. Please block or monitor for all of them. If you find it in your theme files, check with your developer and test before you remove it. We will tell you if we find more.
Email support@getswym.com. If shoppers tell you they were sent to another website from your store, tell us straight away, with the page and the time.
Helping e-commerce brands craft a more seamless experience for their customers
