Is the email about a security incident real, or is it phishing? The email sent on 19 October 2026 with the subject "Security incident affecting ShopFactory - action required", signed by Michael Veith, is genuine. It was sent by us, from ShopFactory News (sales@shopfactory.com). If you received it, please act on it.

We are publishing this page because a message like that one is exactly what a scam would imitate, and you should not have to take an email on trust.

How to check for yourself, without clicking a link in any email

• Go to www.shopfactory.com by typing the address yourself.
• Scroll to the bottom of the page and click Support in the menu at the bottom.
• Scroll to the bottom of the support page, to the section "I have forgotten my ShopFactory 9 - 15 account details".
• Click the link to "Please click here to recover your Total Care user name or password".
• On the next page click "I forgot my password".

That is the same password page the email links to, reached without using a link from an email.

What we will never do

We will never ask you for your password, and we will never ask you to confirm card or bank details by email. Expect fake emails that imitate the official notice and lead to a convincing copy of a login page. If a message asks for any of those things, it is not from us.

What the email asks you to do

1. Change your ShopFactory password today, at https://tc.shopfactory.com/html/en-us/new_lost_password.html. The new password applies to both the ShopFactory desktop software and your ShopFactory Cloud / Total Care account. Choose a password you use nowhere else, and if you have used your old one on another service, change it there too. The password must be at least 8 characters and at most 20, and it is best to avoid the characters # ? @ ! in it. More on that here: https://shopfactory.deskpro.com/kb/articles/359.
2. Ask your own shop customers to change the password on their account in your shop, and anywhere else they have used it. If you would like help with the wording, ask us and we will send you a draft.
3. Replace the API keys and integration credentials connected to your shop: shipping providers such as SendCloud, reviews, accounting, payment providers. For each one, generate a new key in that provider's own account and then enter it in your shop settings in place of the old one.
4. Consider your own obligations. You are the data controller for your customers' personal data and we are your processor, so depending on your own assessment you may need to notify your national data protection authority and your customers. We will provide the information you need for that assessment, and we recommend you take your own legal advice.

Questions about your own shop

Open a ticket at https://shopfactory.deskpro.com/en-US/new-ticket and include your shop address. We will answer about your shop specifically. A follow-up message was promised for Wednesday 21 October 2026, including if nothing further has been established by then.