Downpay is not affected by the Shopify checkout hijacking campaign
Last updated:
In October 2026, public reports described a campaign in which shoppers on some Shopify stores were redirected from the real checkout to a fake checkout page that collected card details. The malicious code reached those stores through several third-party Shopify apps, mainly via “custom code” settings that those apps load from their own servers onto the storefront. We have investigated whether Downpay or any store using Downpay could be affected through our app.
Short answer: Downpay is not one of the affected apps, and we found no evidence that Downpay, our systems or the code we deliver to your storefront were compromised.
What we checked, and how Downpay is built
Downpay’s design does not offer the entry point that the attackers used.
Nothing on your storefront is loaded from Downpay's servers
Downpay's storefront code is a Shopify theme app extension. It is built from our source code by our deployment pipeline and served by Shopify's own CDN. It does not download scripts, configuration or "custom code" from Downpay's servers at runtime, so there is no remote setting that could be altered to inject a script into your store.
Downpay never redirects or replaces your checkout
Downpay does not hook your theme's checkout button and never sends shoppers to a checkout page of its own. The only checkout destination in our code is the one Shopify provides for your store.
No custom JavaScript feature
Downpay has no setting, for merchants or for our staff, that stores JavaScript and runs it on your storefront. The abuse seen in the reported incidents relied on exactly that kind of setting.
Minimal Shopify permissions
Downpay does not request permission to edit your theme, add script tags, add web pixels or modify your checkout. We request only what deposits and payment plans need.
Our records show no sign of compromise
We reviewed our deployment history, the code Shopify serves for Downpay, our staff access logs and our production data for the indicators published in the public reports. We found none of them, and no unauthorized access to our systems.
Staff access is protected
Every Downpay staff account requires two-factor authentication, and only our automated pipeline can publish a new version of the app to Shopify.
What you can do as a merchant
Even though Downpay is not affected, this campaign involved other apps, and the same store can run many. We recommend every Shopify merchant take these steps:
- Open your store in a private browser window, add a product to the cart and start checkout. The address bar should stay on your own domain or on a Shopify checkout domain, never on another site.
- Review the apps installed on your store and remove any you no longer use.
- Change your Shopify password and the passwords for any app accounts, and make sure two-factor authentication is on for every staff member.
- Contact Shopify support immediately if your checkout ever lands on a page you do not recognize.
Questions? Reach us through the chat on this site or on our contact page, and we'll be glad to help. Our full security measures, privacy policy and data processing terms are on the legal page.
Public reporting on the campaign: romanzipp.com. Shopify has since added a confirmation step before a store sends a shopper to an outside website.