On October 18, 2026, Swym switched off Wishlist Plus for every merchant after detecting "attempts by an unauthorized third party to inject scripts into a limited number of merchant storefronts" that "attempted to redirect shoppers away from the merchant's store." Wishlists don't work on any store using it while it's off.
It was Swym's second incident that week. On October 14, between about 10:06 and 11:56 UTC, Swym says "an unauthorized change to the app's configuration" loaded a script on a subset of storefronts. Shoppers who typed a card number into checkout between 10:06 and 16:32 UTC that day may have been redirected. Swym says it doesn't collect, process or store card data.
Hulk Product Options and Selleasy confirmed similar attacks that week, and Shopify disabled Boost AI Search & Filter over a security issue. In every confirmed case, malicious code came from the vendor, not the merchant's theme. Our summary of the October incidents covers each one.
Don't uninstall Swym yet
Swym warns that uninstalling can lose your shoppers' saved products and back-in-stock signups. Leave the app installed while you decide.
Check your store now
- Test checkout the way a shopper would. Open a private window, add a product, click Checkout, and confirm you land on your real checkout. Repeat a few times in fresh windows.
- See what's broken without Swym. Wishlist hearts, the wishlist page and any "save for later" buttons are gone. Check that their empty spaces don't break your product pages or collection cards.
- Check what else depends on Swym. Many stores use Swym for back-in-stock alerts, and some tie it to email flows. Those may have stopped too.
- Turn on two-factor authentication for Shopify staff and collaborators, and for your Swym login.
- If you saw redirects on October 14, consider telling shoppers who paid by card that day, and check your duties under your payment processor agreement and local law.
Option 1: Another wishlist app
Shopify has no built-in wishlist, so another app is the quick swap. The App Store has many; we haven't audited them for this article. Before installing, ask:
| Question | Why it matters |
|---|---|
| Can scripts or HTML be added through your dashboard? | That's how the October attacks ran. |
| Can you import our existing Swym wishlists? | Otherwise your shoppers start from empty. |
| Where are wishlists stored, and can we export them? | You want the data to be yours if you leave. |
| Do you support two-factor authentication on every account? | Vendors that explained a cause pointed to compromised credentials. |
| What happens to product pages if your servers go down? | A missing heart is fine. A broken add-to-cart button is not. |
Option 2: A wishlist you own
A wishlist is one of the simplest things to build into your store instead of renting.
A custom wishlist saves products on each signed-in customer's Shopify record. Guests' lists stay in their browser and merge into their account at sign-in. No third-party script loads on product pages, there's no monthly fee, and the data never leaves Shopify. Back-in-stock alerts can move to your email platform; Klaviyo has them built in.
It's a small project, and you own every line.
Talk to us about custom Shopify app development
Before you change anything: an App Risk Audit
Black Friday is November 27, and most stores freeze code a couple of weeks before. Our App Risk Audit maps every app on your store, identifies those that can run code from their dashboards, tests what breaks when each fails, and provides a written fallback plan for each critical app.
Book an App Risk Audit before Black Friday
FAQ
When will Swym Wishlist Plus be back?
Swym will restore the app "only once we are satisfied it is appropriate to do so." Check Swym's updates or contact support@getswym.com.
Will I lose my wishlists if I uninstall Swym?
You may. Swym advises merchants not to uninstall. Export or migrate the data before removing the app.
Were my customers' card details stolen?
Swym says it doesn't handle card data. Shoppers on affected stores risked being redirected to a fake checkout and entering card details there, mainly on October 14. Wallet payments like Shop Pay and PayPal weren't affected the same way.
Does Shopify have a built-in wishlist?
No. The options are an app or a custom build on your store.
