Shopify denies it was hacked, links stolen data to third-party app

Shopify is denying a platform-wide breach after a threat actor known as '888' began selling customer records they claim were taken from Shopify in 2024; Shopify attributes the exposure to a third‑party app and says the app developer will notify affected customers. Shared data samples include customer IDs, names, emails, phone numbers, and purchase history, and the seller has previously marketed data from other organizations.