Data Export (listed on the Shopify App Store as Data Export IO: Reports) is ISO certified, does not run on PHP, and deletes your store data within 48 hours of uninstall. It was not named in any reporting on the October 2026 Shopify app attacks.

Key highlights

  • Data Export is ISO certified. Your store data is handled by a certified service.
  • Your store data is deleted within 48 hours of uninstalling. Nothing lingers after you leave.
  • Data Export does not run on PHP. The two critical PHP flaws patched in October do not apply to it.
  • You choose what leaves your store. You set the fields, filters, schedule, and destination for every report.
  • The October attacks ran through other apps' storefront code. Attackers used at least three apps to redirect shoppers to fake checkout pages, and Shopify's own checkout was not breached.
  • Data Export was not named in the incident reporting. It is live on the Shopify App Store and does not appear on Revenue Shield's list of delisted apps (updated October 27).
  • A delisting is not proof of a breach, and it does not uninstall the app. Shopify delisted 563 apps between October 14 and 27, most with no public reason, and a delisted app keeps running until you remove it.
  • The PHP and Node.js flaws only matter to apps running unpatched software. Fixes were released in October, and Shopify's core platform runs on Ruby on Rails, so there is nothing to patch on the store side.

What is Shopify app data security?

It is how well an app protects the store data you let it use. Every Shopify app runs on its developer's servers, not inside your store, and connects to your store through Shopify. When you install one, you give it access to store data, and its servers hold the access tokens that make that connection. So the app's security practices decide how safe that data is.

Shopify sets a baseline. Its protected customer data rules, as summarized by Cybersecify, require encryption at rest and in transit. Apps that handle names, addresses, phone numbers, or emails also need encrypted backups, limited staff access, access logs, and a security incident response policy. App review adds checks for common web vulnerabilities, a valid TLS certificate, and correctly sized access tokens.

On October 15, 2026, Shopify added shopify app security check, a command that scans an app's source code for 37 named issues, 25 of them high severity. Shopify says a clean report is not a guarantee and should sit alongside other safeguards. That is why independent certification and clear data practices matter too.

Five things to look for in any app:

  • Independent certification. A recognized standard, such as ISO, shows the vendor's security practices have been checked.
  • Minimum permissions. The app should ask only for the store access its features need.
  • No unneeded storefront code. Apps that run code on your storefront or checkout carry the most visible risk.
  • Clear data retention. You should know how long the app keeps your data after you uninstall.
  • Open communication. A good vendor explains what it does with your data and answers security questions.

What happened in October 2026?

Three stories reached merchants within days of each other: attacks on app-delivered checkout code, a wave of App Store removals, and two critical server-software flaws. They are separate events, and each has a different effect on your store.

The checkout attacks

Between October 10 and 20, attackers used at least three Shopify apps to redirect shoppers from the checkout button to fake checkout pages on look-alike .top domains. The fake pages captured card and billing details, then passed the shopper on to the real checkout, so orders still completed. Developer Roman Zipp first traced a fake checkout to Hulk Product Options on October 10, and the developers of Hulk Product Options, Selleasy, and Swym Wishlist Plus confirmed the incidents. LetsMetrix's timeline says the malicious code arrived as app data, such as a custom JavaScript setting, so merchants' theme files looked clean, and the script ran only once per browser session. It also says there is no evidence that Shopify's own checkout was breached.

The app delistings

Revenue Shield counts 563 apps removed from the App Store between October 14 and 27, 12 of them with more than 1,000 reviews, and 108 have since returned. Shopify has not explained most removals. Apps leave the store for ordinary reasons too: LetsMetrix counted 512 unlisted apps from September 22 to October 21, about 17 a day. A delisting blocks new installs but does not uninstall the app, so a delisted app keeps running on stores that already have it.

What about the PHP and Node.js flaws?

PHP and Node.js are programming languages that many app developers use to run their servers. In October, researchers found serious bugs in both, and fixes are available. Only apps that run the unpatched software are exposed.

  • PHP (CVE-2026-109618 and CVE-2026-109619). Two critical bugs that could let an attacker run commands on a server running unpatched PHP. PHP released fixes on October 21, as Rapid7 explains. The Hacker News reports that the U.S. cybersecurity agency CISA added both to its list of actively exploited flaws on October 26, and Palo Alto Networks Unit 42 reported attacks on internet-exposed PAN-OS management interfaces on October 29. Sophos says updating PHP is the only complete fix.
  • Node.js (CVE-2026-111497). A bug in a data-decompression component. Singapore's Cyber Security Agency alert rates it 9.8 out of 10 and says fixes are available. It matters only when an app decompresses data that an attacker sends.

What it means for you: Shopify's core platform is built on Ruby on Rails, not PHP, so there is nothing to patch on the store side. The exposure sits with app servers running unpatched software, and the fix is an update from the developer. Data Export does not run on PHP, so the PHP flaws do not apply to it.

How Shopify responded

Shopify told iTnews on October 17, "When an app falls short, we act." On October 20 it said it plans tighter limits on storefront app code, IP restrictions on app API keys, and higher security requirements for listings. It also released the shopify app security check command on October 15 so developers can scan their own code.

How does Data Export keep your store data safe?

Data Export reads your store data through Shopify's API and turns it into reports you control. Safe handling comes first, and these are the commitments behind it.

  • ISO certified. Data Export is ISO certified, so the way we run the service and protect your data meets a recognized international standard.
  • Deleted within 48 hours. When you uninstall Data Export, we delete your store data within 48 hours.
  • Not built on PHP. Data Export does not run on PHP, so the October PHP flaws do not apply to it.
  • You choose what leaves your store. Build a report from the prebuilt library or from any field in your store API, then pick the fields, filters, schedule, and destination. A report that only needs totals can leave customer details out.
  • Built on Shopify's API. Reports are read through the same API Shopify provides to every app, and they arrive by email, Google Sheets, Google Drive, FTP, or a download that you set up.
  • Privacy compliance. GDPR compliance is listed on our Shopify App Store page.
  • Support on every plan. Chat and email support are included on every plan if you have a security question.

Was Data Export affected by the October events?

Data Export was not named in any of the reporting we reviewed on the checkout attacks or the delistings. It is live and installable on the Shopify App Store, and it does not appear on Revenue Shield's delisted-app list as of that list's October 27 update. It also does not run on PHP, so the PHP flaws do not apply to it.

Where does your exported data go?

Reports reach you by email, Google Sheets or Drive, FTP, or a shared link or download. Once a file arrives, your own sharing settings protect it, and Data Export leaves those controls in your hands. The diagram shows the path.

The October attacks hit storefronts; your exports stay under your control

Where the October attacks hit: storefront and checkoutApp code on the storefront redirected shoppers to fake checkout pages. An app that adds no storefront code is not on this path.
Your store dataOrders, inventory, payouts, customers
Data ExportReads data through the Shopify API and builds the reports you set up

Where exported data lands

  • EmailCheck the recipient list
  • Google Sheets or DriveCheck who can open it
  • FTP serverCheck access and encryption
  • Shared link or downloadCheck who holds the file
App security: handled by Data ExportISO certified; data deleted within 48 hours
Your sharing settingsand recipient lists keep each file protected
Data path: from your Shopify store, through Data Export, to your export destinations.

The app's security covers the path into Data Export. Your sharing settings protect each file after it arrives.

How can you keep any Shopify app and your exports safe?

These steps work for every app you have installed. They draw on checklists from LetsMetrix and Ethercycle.

Check your apps

  • List apps that accept custom code. Look for settings that take JavaScript, HTML, or other code. Screenshot them instead of editing them, and keep them empty unless you use them.
  • Review your app embeds. Open the theme editor's App embeds panel and switch off any embed you don't recognize.
  • Test checkout in a fresh private window. The malicious script ran once per browser session, so repeat the test in a new window each time. Open the Network tab and filter for .top.
  • Check each app's App Store status. A delisted app keeps running on your store until you uninstall it.
  • Review requested permissions. A reporting or export app has no reason to write to your theme or checkout.
  • Ask vendors about their security. Good questions: Are you certified? How long do you keep my data after uninstall? Have you applied the October PHP and Node.js updates?
  • Review staff access. Turn on two-step authentication for everyone who logs in, and remove old staff and agency accounts.
  • Review your apps every quarter. Give each app an owner and remove the ones you no longer use.

Protect your exports

  • List every scheduled report and its recipients. Remove former employees, agencies, and anyone who no longer needs the data.
  • Check each Google Sheet's sharing setting. Share with named people, not "anyone with the link."
  • Review FTP and shared-link deliveries. If a report goes to an FTP server, confirm it accepts encrypted connections.
  • Cut customer fields you don't need. A report that only needs totals shouldn't carry names, emails, or addresses.
  • Delete old files. Remove past CSV and Excel exports from shared drives, inboxes, and downloads folders once you've used them.

If something looks wrong

LetsMetrix advises switching the store to password protection, disabling the suspect embed, saving screenshots and URLs, and contacting Shopify Support and the app's developer. Tell affected customers to contact their card issuers. Change your Shopify password and turn on two-step authentication if you haven't.

Frequently asked questions

Is Data Export ISO certified?

Yes. Data Export is ISO certified, so the way we run the service and protect your data meets a recognized international standard.

How long does Data Export keep my data after I uninstall?

Data Export deletes your store data within 48 hours of uninstalling the app.

Was Data Export affected by the October 2026 Shopify app attacks?

Data Export was not named in any of the reporting we reviewed on the checkout attacks or the delistings, and it is live on the Shopify App Store. The confirmed attacks ran through app code on the storefronts of other apps, and Shopify's own checkout was not breached.

Is Data Export affected by the PHP vulnerabilities?

No. Data Export does not run on PHP, so CVE-2026-109618 and CVE-2026-109619 do not apply. Shopify's own platform runs on Ruby on Rails, so merchants have no PHP to patch on the store side.

Can a reporting or export app hijack my checkout?

The October attacks needed app code running on the storefront. Before you install any app, check the permissions it requests and whether it adds embeds or code to your storefront or checkout. Then test checkout in a private window.

Does a delisted app stop working on my store?

Usually not. Delisting stops new installs, but the app keeps running on stores that already have it. You have to uninstall it yourself.

Which customer details can I leave out of a Data Export report?

Custom reports can use any field from your store API, and you can edit, sort, and filter prebuilt reports. Leave names, emails, and addresses out of any report that only needs totals.

How do I know any Shopify app is secure?

Check its App Store status, the permissions it requests, whether it adds code to your storefront, its certifications, and how long it keeps your data after uninstall. After you install an app that touches the storefront, test checkout in a private window.

Ready to build reports you control? Start a 15-day free trial of Data Export on the Shopify App Store.

Try Data Export free for 15 days

Custom reports, 100+ prebuilt reports and scheduled delivery on every plan, from $12 per month.

Start Free TrialSee Pricing
Share this article