Aftersell said an automated attack that started October 7 exposed upsell configuration data, such as discount settings, from 22 Shopify stores, according to a LinkedIn post from CEO Dhruv Patel. Patel denied speculation that Aftersell was part of this month’s checkout hijacking wave, in which attackers changed settings in apps from HulkApps, Selleasy, and Swym to send shoppers to fake payment pages, and said attackers got no shopper or payment data and took no money. Aftersell, which Rokt owns, is off the Shopify App Store while it works with Shopify to get relisted, so new stores can’t install it heading into Black Friday. Rokt’s security team ran the investigation, and Aftersell has brought in outside penetration testers and reported the attack to the FBI.
