Issue: A merchant reports that a now-deleted customer account used an “SQL meta data name” to inject commands into their Shopify domain, compromising some shop information (i.e., a suspected SQL-injection via a name/metadata field).
Requested actions:
Context and evidence: The post does not include logs, screenshots, or technical details beyond the allegation and the request for data disclosure. No remediation steps or security changes are discussed; the focus is on identifying the actor and gathering evidence.
Status/outcome: No responses or decisions are recorded. The request remains open, seeking platform-side investigation and disclosure of IP and location information.
One of our deleted customers used an SQL meta data name in order to inject commands into shopify’s domain and hack some of our shop information.
We need to retrieve the name (a very large name with our domain on it) and we need you to gather the IP that created that customer and send it to us along with the location to take further legal actions.