What should you do if your Shopify account is hacked?

What do you do first when your Shopify account is hacked?

Shopify's instruction for an account you think has been “hacked or compromised” is to contact Shopify Support immediately, and then to “complete the steps below if you can.”

Support chat runs 24/7 on all plans but needs you logged in. Locked out, use the Can't log in form, which says Shopify will “reply within 48 hours”; submitting it doesn't create a Support Inbox ticket. Beyond that form, none of the Help Center articles we read on October 13, 2026 — best practices, contact Support, troubleshooting login, reset password and phishing — names a response time for a hacked account.

Two Help Center pages, both read October 13, 2026, place Support differently. The account security best practices page puts it first. The phishing page puts it third for someone who clicked a link in a phishing email: change your Shopify password, activate two-step authentication, then contact Support. All three actions are on both lists, so do all three in one sitting.

In what order do you lock the attacker out?

Shopify's checklist for a compromised account has eight steps: email password, Shopify password, two-step authentication, suspicious logins, finances, settings and access, orders, and government guides. The first four lock the account:

1. Email. Change the password of the email you log in to Shopify with.
2. Shopify password. Change it. If you can't log in, reset your password: the reset link is valid for 48 hours, and a reset doesn't remove two-step authentication. No reset email? Contact Support. If your credentials turn up in a public data leak that Shopify analyzes, Shopify locks the account, and login shows an error until you reset to an uncompromised password.
3. Two-step authentication. Activate it. If it was already on and the attacker defeated it, for example by stealing your device, remove that device's authentication method and set it up again for a different device.
4. Logins. Review suspicious login activity and log out any device you don't recognize — where you log out a device. If more than five devices have recently logged in, you can click Log out all devices; it also logs you out of the current device.

Beyond Log out all devices (available when more than five devices have recently logged in), the login and security pages we read on October 13, 2026 — log in, reset password, secure sign-in, best practices and phishing — describe no tool that ends every session at once, and the reset password page doesn't say whether a reset ends active sessions.

What do you check in your Shopify finances and orders?

Shopify calls unauthorized Shopify Credit virtual card charges “often a sign of account compromise” and names four financial products to review; read the row for each you use.

Shopify Help Center, read October 13, 2026.

Then review your orders, including suspicious and draft orders: verify them with the customer and cancel or refund as needed to prevent chargebacks. On Shopify Payments, resolve chargebacks within the deadline shown in your admin, “typically 7-21 days” — see how to respond to one.

What else could the attacker have changed in your admin?

Check the rest of the admin:

• Staff and collaborator accounts: review and update them and their permissions, especially staff with sensitive permissions (see who gets admin access).
• Activity log: changes you don't recognize.
• Content > Files: files you didn't add.
• Growth: campaigns created without authorization.
• Apps and Custom apps: any installed app that isn't authorized, any custom app you don't recognize.
• Discounts: any that aren't correct.

In Shopify admin

1. Settings
2. General

Check Store contact details here, then Checkout, Shipping and delivery, Domains and Notifications in the same Settings menu.

Zoom

UI checked October 13, 2026 in our development store

Last, Shopify points to government guides on protecting your identity; its page names Canadian and United States government resources only.