There’s been a lot of speculation about @aftersell over the last week, including some erroneous claims about checkout hijacking. We understand given what's going on in the ecosystem but here's what actually happened to Aftersell 👇 Starting October 7th, an attacker sent millions of malicious requests to our servers. Most failed or did nothing, but the attack exposed non-sensitive upsell configuration data (e.g. discount settings) from a subset of 22 stores and they have of course been notified. It was an automated and almost certainly AI-assisted attack. It sent millions of requests in a single day, and switched to a pool of 1,460 rotating IP addresses. The moment we blocked one, the next one would appear. We closed the vulnerability within two hours. For everyone speculating about checkout hijacking, I want to make it very clear that this DID NOT happen to us. No shopper data or payment info was exposed, and no money moved. Aftersell merchants do not need to take any action - the app remains fully functional. No sensitive data was exposed, but the responsible thing was to take ownership and make sure the security of our product came first. I’d rather take the install hit before BFCM than ask merchants to trust us before we’d checked everything. Here’s what we’ve done since: → We’ve been working closely with Shopify’s security team and have brought in third parties for external incident review, VAPT, and specialized pen testing. → Aftersell is part of Rokt, and Rokt’s security team has run this investigation. The team is led by an ex-FBI cybersecurity leader and recently joined Anthropic’s Cyber Verification Program, which gives our security team access to Anthropic’s most capable models for defensive work. These models are now continuously reviewing every public route on Aftersell and are built into our security stack. → We have informed the FBI and other partners that share cyber threat intelligence to help stop attackers in the ecosystem. We will continue to work with the cybersecurity community to ensure the highest of security standards on Aftersell. → We are working with Shopify to ensure we get re-listed as soon as possible so new stores can install and set up Aftersell ahead of BFCM. Our commitment to the merchants who use or are considering Aftersell: 1) Security comes first on our roadmap. Our entire engineering team has spent the last few weeks on security work, and we’re using AI to defend against AI, with those same models now built into our security stack. We’ll keep investing, and we’ll stay transparent. If something affects your store, you’ll hear it from us. This is an always on program. We contacted affected merchants, we will always do this to ensure you know what is going on. 2) We’ll share what we learn. Attacks like this are becoming more common by the day across all platforms and we want to help our partners get ahead of them too. More on this soon. If your Shopify app has been hit by something similar, DM me. Happy to share our notes and learnings. We take a lot of pride in serving a large portion of the Shopify ecosystem, and we’re committed to building the best and most secure upsell product out there. If you have questions, comment below or DM me directly.