Summary
- Shelly Store UK discovered unauthorised software after receiving a warning from Stripe.
- The retailer has contacted customers who may have supplied payment information during the affected period.
- The incident concerns the UK reseller, not a confirmed compromise of Shelly's connected devices.
Shelly Store UK has notified customers of possible payment information exposure after unauthorised software was identified on its ecommerce website and server. The UK retailer began examining its systems following an alert from payment provider Stripe, and subsequently reported the matter to the Information Commissioner’s Office.
The business said it removed the unauthorised software, strengthened access controls, applied security updates, and introduced additional monitoring. Customers who placed orders during a potentially affected period have been contacted, although the full exposure window and precise categories of information taken have not been established publicly.
A customer notification examined by The Register described the investigation and steps taken by the retailer. The outlet also reported that one customer had encountered suspicious charges before receiving the warning. That sequence is relevant to the customer’s experience but does not prove those charges were caused by the malicious code identified on the retailer’s site.
Unauthorised software on an ecommerce server can affect several parts of a transaction. Malicious code might intercept information entered by a customer, alter content displayed during checkout, or access records stored by the merchant. The consequences depend on what the code actually did, where payment information was processed, and what data the server could reach.
Payment platforms often reduce the amount of sensitive card information merchants need to handle directly. However, a secure payment processor does not necessarily protect the integrity of every script running on a customer’s checkout page. Investigators must establish which components were controlled by the retailer and which belonged to external providers.
Shelly Store UK is operated by Advanced IOT Ltd and sells connected home and automation equipment. It is a separate retail business from the manufacturer of Shelly smart devices, so the incident does not establish compromise of the manufacturer’s firmware, hardware, or cloud infrastructure. The company distinction is important to the scope of the warning.
The retailer’s investigation must also consider whether the unauthorised software persisted across more than one version of its website and whether customer information was stored locally. Records from hosting providers, payment processors, and security monitoring can be combined to reconstruct the period when malicious components were present.
Where a website stores personal records associated with transactions, the legal assessment may extend beyond payment-card exposure. Names, contact details, addresses, and order histories are personal data when linked to customers. Whether disclosure to the regulator was required depends on the likelihood and severity of risks arising from the incident.
Notification of an incident to the ICO is not itself a finding that a business has breached data protection law. The regulatory assessment depends on the nature of the affected information, the controls applied, the timeline of discovery and response, and the evidence produced during the investigation.
Specialist retailers often depend on outside providers for hosting, ecommerce software, payment services, and site extensions. Responsibility for investigating a website compromise can therefore be distributed across multiple companies even though the merchant remains the primary point of contact for its customers.
For the business, restoring the website does not necessarily end the incident response. Customers may need clear information about the data potentially exposed and the steps their payment provider recommends. Any transactions reported as fraudulent must be assessed against available evidence rather than attributed automatically to the website issue.
Shelly Store UK says the unauthorised software has been removed and monitoring increased. The central unresolved questions are whether customer payment information was actually extracted, which transactions were potentially affected, and whether the code reached anything beyond the retailer’s ecommerce environment.
The incident concerns a live commercial website, making preservation of relevant logs and communication with payment providers important while the forensic review continues. No confirmed compromise of the underlying Shelly smart home devices has been identified in the available account.
