.svg)
On 13 October 2026, Selleasy: Upsell & Cross Sell, our Shopify app, was the target of a deliberate external attack that placed an unauthorized script on a number of merchant storefronts. We contained it the same day, removed it from every affected store, and closed the route the attacker used. Selleasy has since been independently assessed and reviewed by Shopify, and was re-listed on the Shopify App Store on 27 October 2026.
This page explains what happened, how we responded, and the steps we’ve taken to further strengthen our security.
Key facts
| App | Selleasy: Upsell & Cross Sell (Shopify app by Logbase) |
|---|---|
| Incident date | 13 October 2026 |
| Status | Resolved |
| Threat contained | 12:22 UTC, 13 October 2026 |
| All affected stores cleaned | 15:58 UTC, 13 October 2026 |
| Independent verification and VAPT | Astra Security, 16–20 October 2026 |
| Shopify review | Completed; re-listed on the Shopify App Store on 27 October 2026 |
What happened
An attacker targeted a legacy internal support tool. Through it, they injected a malicious script into a number of Selleasy storefronts, designed to redirect some shoppers to an external website at checkout.
This was a deliberate, planned attack. It was carried out over a few hours through an anonymising network, specifically to hide its origin. Merchants’ Shopify accounts and credentials were not used in the attack.
Timeline
All times are UTC. The redirect was stopped across every store at 12:22 UTC on 13 October, and all affected stores were fully cleaned by 15:58 UTC the same day.
| Date and time (UTC) | What happened |
|---|---|
| 13 Oct, early hours | Attacker gains access to the legacy support tool |
| 13 Oct, 07:47 | Attacker begins adding the malicious script to stores at scale |
| 13 Oct, 12:22 | Custom scripts disabled across all Selleasy stores; redirects stop |
| 13 Oct, 14:59 | We reported the incident to Shopify |
| 13 Oct, 15:58 | Malicious script removed from every affected store |
| 15 Oct | App credentials rotated as an added precaution |
| 16–20 Oct | Independent assessment, verification, and vulnerability assessment and penetration testing (VAPT) by Astra Security |
| 27 Oct | Selleasy re-listed on the Shopify App Store after Shopify’s review |
How we responded
Our first priority was to stop the attack and protect every store, then to be open about what happened.
- Contained it. We switched off custom scripts across all Selleasy stores at once, which stopped the redirect everywhere.
- Shut the door. We permanently shut down the legacy tool the attacker used.
- Cleaned up. We removed the malicious script from every affected store and restored any merchant settings that had been overwritten.
- Reported it. We reported the incident to Shopify ourselves the same day, and have worked closely with their team since.
- Brought in independent experts. We engaged Astra Security, an independent security firm, to assess the incident and verify the measures we took.
- Informed merchants. We notified affected merchants directly once Shopify had reviewed our communication.
How we’ve strengthened our security
Beyond containing the attack, we have strengthened security across Selleasy.
Removed the attack path entirely
- The legacy support tool has been permanently decommissioned, and its web address no longer exists.
Secured credentials and access
- We rotated the app’s secret keys and invalidated all sessions linked to the retired tool.
Strengthened monitoring
- We added a web application firewall with rate limits and alerts on unusual activity.
Reviewed everything else
- We audited all our systems and services to make sure nothing retired is still running.
- We completed a full vulnerability assessment and penetration test (VAPT) of Selleasy, and all findings have been fixed and retested.
Independently verified, and reviewed by Shopify
We didn’t want merchants to take our word for it, so we asked independent experts to check our work.
Astra Security, an independent security firm with no part in building or running Selleasy, assessed the incident and verified the measures we took between 16 and 20 October 2026.
The firm also carried out a full vulnerability assessment and penetration test of Selleasy. Shopify reviewed the incident report, the test results and our remediation, and Selleasy was re-listed on the Shopify App Store on 27 October 2026. Selleasy is fully operational for all merchants.
What you need to do
No action is needed in Selleasy. If you turned off the Selleasy app embed during the incident, you can turn it back on.
If you have any questions about your store, contact us at communication@logbase.io and our team will help.
Our commitment
We sincerely regret the disruption this caused. Thousands of merchants trust Selleasy with their storefronts, and we know how unsettling it is when a tool you rely on is targeted. This experience has made us an even stronger team.
Security is now at the centre of how we build and run Selleasy. We will keep investing in it, keep our defences under independent review, and be open with you if anything ever affects your store.
Thank you for your patience and your trust.
The Selleasy team at Logbase
.svg)
.svg)
.svg)
.svg)