Cyber Threat Actor: Two rogue Shopify employees

Two individuals identified only as “rogue” Shopify employees were implicated in a September 2020 incident in which they illegitimately accessed customer transactional records belonging to certain merchants using the Shopify platform. The actors were based in Ottawa, Canada, and were members of the company’s support team, giving them legitimate internal credentials that they abused to view data outside the scope of their duties. Shopify terminated their network access immediately after discovering the unauthorized activity and referred the matter to law enforcement, including the Federal Bureau of Investigation, while also notifying affected merchants. No public description of the actors’ affiliations, broader criminal network, or state sponsorship has been released, and they are known solely by the alias “two rogue Shopify employees” in connection with this breach.

The incident demonstrates an insider‑threat vector where trusted employees exploited their privileged access to obtain sensitive merchant data, specifically transactional records that could include purchase histories, payment details, and personal information of end‑users. The targeting was confined to the e‑commerce sector, affecting merchants that rely on Shopify for online storefronts, although the geographic scope of the impacted merchants was not detailed in the available reporting. The actors did not employ malware, custom tooling, or external intrusion techniques; their method relied solely on the misuse of existing internal access privileges. Consequently, no specific malware families, exploit kits, or command‑and‑control infrastructures are associated with this threat actor.

Attribution to any criminal consortium, nation‑state, or organized group remains undetermined based on publicly available sources, and no additional campaigns or operations have been linked to these individuals beyond the 2020 Shopify data breach. The case is frequently cited as a representative example of how insider privilege can lead to data exposure even within well‑secured technology firms, highlighting the importance of monitoring internal user activity and enforcing strict least‑privilege principles. Law‑enforcement involvement, particularly the FBI’s participation, underscores the seriousness with which such breaches are treated when they involve cross‑border data protection concerns.