Resolved after 5 days 3 hours, on October 22, 2026.
We consider this incident resolved, as we have no evidence that Gorgias has been affected. As part of our investigation, we: - Checked our storefront and checkout code (chat, self-service, Convert and our Shopify extension) for every known indicator of compromise. We found none. - Reviewed the last 30 days of infrastructure and CDN logs for the scripts we serve to storefronts and checkout. We found no sign of tampering or abuse. - Confirmed that the scripts we serve exactly match what our build pipeline produced. As a precaution, we're applying extra hardening measures and following Shopify's security recommendations for app partners. Our engineering team will continue to monitor the situation closely. We still recommend that store owners review the third-party apps installed on their store and follow Shopify's guidance for any app they're unsure about. If you see anything unusual related to Gorgias, contact us at [email protected].
Update timeline
- investigating Oct 22, 2026, 12:19 PM UTC
We’re aware of a campaign targeting third-party apps on Shopify stores, where malicious code can be delivered to shoppers’ browsers through compromised app providers. After an initial investigation, we can confirm we have no evidence that Gorgias is affected. Our engineering team is actively monitoring the situation, and we are verifying the integrity of the scripts we serve to your storefront. We’ll send an update as soon as we have more information. In the meantime, we recommend reviewing the third-party apps installed on your store and checking Shopify’s guidance for any app you’re unsure about. If you see anything unusual related to Gorgias, contact us at [email protected].
- monitoring Oct 22, 2026, 08:58 PM UTC
Our engineering team continues to investigate the Shopify third-party app security campaign. At this point, we have no evidence that Gorgias has been affected. We are continuing to verify the integrity of our storefront scripts and monitor incoming customer reports. We will continue providing updates as our investigation progresses. If you notice any suspicious behavior related to Gorgias, please contact [email protected]
- resolved Oct 27, 2026, 03:33 PM UTC
We consider this incident resolved, as we have no evidence that Gorgias has been affected. As part of our investigation, we: - Checked our storefront and checkout code (chat, self-service, Convert and our Shopify extension) for every known indicator of compromise. We found none. - Reviewed the last 30 days of infrastructure and CDN logs for the scripts we serve to storefronts and checkout. We found no sign of tampering or abuse. - Confirmed that the scripts we serve exactly match what our build pipeline produced. As a precaution, we're applying extra hardening measures and following Shopify's security recommendations for app partners. Our engineering team will continue to monitor the situation closely. We still recommend that store owners review the third-party apps installed on their store and follow Shopify's guidance for any app they're unsure about. If you see anything unusual related to Gorgias, contact us at [email protected].
Your product runs on more than Gorgias
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services