Shopify Customer Data Breach by Rogue Support Agents
On September 22, 2020, Canadian multinational e-commerce company Shopify Inc.
Key points
- On September 22, 2020, Canadian multinational e-commerce company Shopify Inc. disclosed a security incident where "two employees went 'rogue' and stole customer information." These insider threat actors illegitimately accessed records connected to fe
- Shopify Customer Data Breach by Rogue Support Agents
Connected intelligence
Signal brief
Follow the organization, likely method and potential impact to explore connected Shadow Tier intelligence.
Organization
- Published
- Jan 1, 2020
- Updated
- Aug 5, 2026
- Confidence
- High
- Evidence
- 5 sources
Structured assessment
Signal analysis
This analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Threat source
Watch exposure paths that could affect data, operations or third-party trust.
- Source type: possible insider or internal misuse
Business impact
- Impact area
- Confidentiality
- Likely asset
- User or customer data
Mentioned entities
Quick context
Questions about this signal
What happened in this signal?
On September 22, 2020, Canadian multinational e-commerce company Shopify Inc. disclosed a security incident where "two employees went 'rogue' and stole customer information." These insider threat actors illegitimately accessed records connected to fewer than 200 of Shopify's merchants. The compromised customer data included email addresses, names, addresses, and order details. Shopify immediately terminated the individuals' access to their network and referred the incident to law enforcement, working with the FBI and other international agencies in their investigation of these criminal acts. At the time of disclosure, there was no evidence to suggest that the stolen data had been used. Shopify notified the affected merchants about the incident.
When was this signal reported?
Shadow Tier lists Jan 1, 2020 as the signal date.
Which organization is connected to this signal?
Shop is the organization connected to this public signal.
Explore ShopWhich impact area is relevant?
This signal is connected to data exposure and breach intelligence based on its reported consequences.
Explore data exposure and breach intelligenceRelated signals
Compare shared topics, actors and incident patterns before opening the full signal.
Coupang Data Breach: Authentication Failures Expose Customer Data in South Korea
South Korean e-commerce giant Coupang experienced a significant data breach between April and November 2026, with an additional access attempt in January. South Korea's Deputy Minister for Cybersecurity and Network Policy publicly attributed the incident to management failures and authentication vulnerabilities during a press conference on July 24, 2026. The attacker exploited user authentication vulnerabilities to gain unauthorized access to accounts without proper login credentials, leading to a large-scale unauthorized information leak. South Korean authorities emphasized that the breach was not the result of highly sophisticated intrusion techniques, but rather stemmed from fundamental security weaknesses in authentication mechanisms and inadequate security management practices. The breach resulted in large-scale unauthorized access to customer information. The unauthorized access has since been terminated. This incident has also led to a record fine of $422 million by South Korea's Personal Information Protection Commission (PIPC) and ongoing diplomatic discussions between South Korea and the U.S. due to Coupang being an American-owned company operating in South Korea.
Related context
Lidl Czech Republic E-shop Customer Data Breach
Lidl Czech Republic announced a security incident on July 10, 2026, affecting its e-shop customers. Attackers gained access to a separately stored file containing customer data from an IT service provider. The compromised data includes customers' salutations, first and last names, phone numbers, email addresses, dates of birth, and customer numbers. Lidl confirmed that passwords, billing and delivery addresses, bank details, or other payment information were not affected, and customer accounts were not compromised. The company stated that it currently has no concrete evidence of data misuse but has proactively warned affected customers about potential phishing attempts or identity theft. The IT service provider involved has taken measures to restore system security, filed a criminal complaint, and engaged IT experts for the investigation. The Office for Personal Data Protection was also informed of the incident. Lidl began notifying affected customers via email after discovering the incident earlier in the week.
Related context
Origin Energy Discloses Data Breach Affecting 900,000 Customers
On July 28, 2026, Origin Energy, a major Australian energy company, publicly confirmed a significant data breach impacting approximately 900,000 current and former customers. The breach led to unauthorized access and exfiltration of personally identifiable information (PII), including names, addresses, dates of birth, phone numbers, account details, and partial payment information such as the last four digits of credit cards or the BSB and last three digits of bank accounts. Origin Energy first identified a potential security threat in early July 2026, which was initially not deemed credible. However, new information on July 22, 2026, confirmed a security incident had occurred, prompting immediate action and notification of authorities. An alleged hacker provided a media outlet with a sample of 50 customer records and screenshots of internal Origin Energy systems, corroborating the data exfiltration. The incident is currently under investigation by Australian authorities, including the Australian Cyber Security Centre, the National Office of Cyber Security, the Australian Federal Police, and the Office of the Australian Information Commissioner. The specific technical vector used for initial access remains undisclosed.
Related context
Municipality of IJsselstein Takes Files Offline Due to Data Leak
The municipality of IJsselstein removed several documents from its website on July 27, 2026, after a resident discovered that they contained personal data. These documents were found within the municipal council's information system, which violates privacy legislation. The municipality has reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and is reviewing all published meeting documents dating back to January 1, 2014. While affected individuals will be informed, the specific types of data exposed have not been disclosed. Locoburgemeester Peter Bekker emphasized the need to restore trust in the handling of personal data and prevent future occurrences. An investigation into the error is expected to take several months, during which parts of the system may be temporarily inaccessible.
Related context
Jamf Affected by Klue Customer Data Incident
Jamf, a company specializing in Apple device management, was among roughly two dozen Klue customers impacted by a data incident. The incident, which became active on July 26, 2026, involved the Icarus threat group claiming responsibility for an attack. Further reports indicated that another hacking group might have obtained samples of the stolen Klue customer data and attempted to extort affected companies directly. While the full extent of Jamf's specific exposure through this third-party incident is not detailed, the broader event highlights the risks associated with supply chain compromises. Jamf's security efforts include initiatives like its Beacon threat-hunting service, which focuses on proactive detection and analysis of Mac threats, and its annual Security 360 report, which addresses key threats to Apple endpoints.
South Korean Domain Registrar Gabia Hacked, Exposing 350,000 User Records
South Korean domain registrar Gabia experienced a cyberattack on Saturday, July 26, 2026, which impacted the online connectivity of approximately 100,000 registered domains. The incident led to the exposure of data belonging to 350,000 users. The compromised information included names, user IDs, passwords, and registration numbers. This breach highlights the significant risks associated with compromised credential reuse, as a large portion of the exposure originated from "Combolist sources." Additionally, active infostealer activity, linked to malware families such as LummaC2, Redline, and Rhadamanthys, was identified, further indicating a focus on credential theft impacting both clients and employees. The incident also revealed 245 compromised employee accounts, posing an infrastructure risk, and 30,782 leaked client credentials, creating regulatory liability. The timeline of related events showed an increase in client-related incidents from August 2025 through April 2026, with a peak in March 2026, and spikes in employee-related events in January, April, and May 2026. Remediation efforts should prioritize credential hygiene, multi-factor authentication enforcement, and enhanced monitoring for suspicious login activity, particularly targeting login forms and account management services. The incident was reported by the Korea Herald on Monday, July 28, 2026.