 |
| Seiko has suspended its online wishlist service following a security incident involving third-party software provider Swym. |
Seiko has suspended the wishlist functionality on three of its Japanese e-commerce platforms after a security breach involving third-party software provider Swym.
The Japanese watchmaker announced on October 30, 2026, that it had removed the Wishlist Plus application from its Grand Seiko Boutique Online, Seiko Online Store, and Seiko Clock Online Store as a precautionary measure. The company confirmed that customers can no longer access the favourites function while it investigates whether the incident affected its websites.
Malicious Code Redirected Shoppers at Checkout
According to Swym's security response published on October 16, an unauthorised party modified the Wishlist Plus app configuration on October 14, 2026, between 10:06 and 11:56 UTC. This change caused a malicious script to load on certain pages across a limited number of storefronts using the application.
The injected code specifically targeted checkout buttons, attaching an event listener that triggered only when shoppers clicked to complete a purchase. Affected customers may have been redirected to an external website designed to imitate a legitimate checkout page and collect payment card details.
Swym began deploying fixes at 15:02 UTC, with all remediation completed by 16:32 UTC. The company subsequently revoked application credentials, removed the injected script, and implemented enhanced security controls.
No Confirmed Data Breach at Seiko
In official notices published on both the Seiko Online Store and Grand Seiko Boutique Online, the watchmaker stated that it has not confirmed any leakage of customer personal information held by its online stores. The company continues to investigate the incident's potential impact on its platforms.
Swym similarly reports no evidence that merchant accounts or customer information stored within its application were compromised. However, the company acknowledges in its security FAQ that shoppers who manually entered details on the fraudulent external payment page may have exposed their information.
.jpg) |
| Seiko's online store published a security notice on 30 October 2026 following an incident involving Wishlist Plus provider Swym. |
Swym's Response and Remediation
The California-based e-commerce technology provider has taken extensive measures to contain the incident. According to its official security update, Swym:
- Identified and removed the malicious code injection from affected storefronts
- Rotated API secrets and internal access credentials across all application microservices
- Restricted endpoints matching the attack pattern and added additional authentication layers
- Implemented enhanced client-side and server-side sanitisation rules to prevent future code injection attempts
Swym also temporarily suspended Wishlist Plus across all merchants—including stores not directly affected—before beginning a phased restoration process. The company has identified the malicious domain as checkout-guard[.]top and warned merchants about similar domains observed in broader Shopify ecosystem attacks, including account-confirm[.]top, billing-confirm[.]top, and checkout-secure[.]top.
Customer Advisory Issued
Seiko has urged customers to exercise caution when receiving suspicious emails or text messages claiming to relate to the incident. The company specifically warned against accessing unfamiliar URLs, opening attachments, or entering personal information in response to such communications.
The watchmaker has not announced when the wishlist feature will be restored, stating that further updates will be provided as its investigation progresses.
What Customers Should Know
For consumers who used the affected Seiko online stores during the incident window, Swym's FAQ advises reporting any unexpected checkout behaviour to the company's support team. Shoppers who believe they may have entered payment details on a fraudulent page should monitor their card statements and consider contacting their financial institution.
Seiko customers seeking assistance can reach the Grand Seiko Boutique Online customer service line at 03-3572-6535, operational from 11:00 to 19:00 Japan Standard Time on weekdays.