Shopify says stolen customer data was taken in third-party breach

A threat actor posting under the handle "888" claims to be selling 179,873 Shopify customer records containing Shopify IDs, names, email addresses, mobile phone numbers, and transaction/subscription metadata. Shopify says its systems were not breached and blames a third-party app; the report links this event to prior third-party exposures (a Saara MongoDB leak and breaches affecting partners of Evolve Bank & Trust). The article recommends standard post-breach actions such as changing passwords, enabling 2FA, monitoring for phishing, and considering identity monitoring.