Seiko disables online store feature following third-party security incident

Seiko has suspended its wishlist feature across three Japanese online stores following a security incident involving third-party software provider Swym. The watchmaker announced the decision on 30 October 2026, confirming that the Wishlist Plus application had been removed as a precaution.

The suspension affects Grand Seiko Boutique Online, Seiko Online Store and Seiko Clock Online Store. Customers can no longer use the affected favourites function, while the company investigates whether the incident had any impact on its websites.

The incident extended beyond the disruption of a shopping feature. According to Swym's incident report, an unauthorised party modified the application's configuration on 14 October, causing malicious code to load on certain pages of a limited number of online stores.

Attackers targeted checkout buttons

Swym says the injected script could redirect shoppers who clicked checkout buttons to an external website imitating a legitimate payment page. Anyone who entered their card details on the fraudulent site could potentially have exposed that information.

The unauthorised configuration change occurred between 10:06 and 11:56 UTC on 14 October. The provider began deploying fixes at 15:02 UTC, completing the rollout at 16:32 UTC.

In its 20 October security FAQ, Swym clarified that the malicious code targeted checkout-button interactions on affected product, collection and cart pages. It did not automatically capture information entered into legitimate store checkout forms.

The company subsequently revoked application credentials, removed the injected script and strengthened its security controls. It also temporarily suspended Wishlist Plus across all merchants, including stores not directly affected by the attack, before beginning a phased restoration.

No confirmed customer data leak at Seiko

Seiko says it has not confirmed any leakage of personal information held by its online stores. The company has not disclosed whether any of its customers were redirected to fraudulent checkout pages.

Swym likewise reports no evidence that merchant accounts or customer information stored within its application were compromised. However, its investigation acknowledges that shoppers who manually entered information on an external fraudulent payment page may have exposed their details.

Seiko has warned customers to exercise caution when receiving suspicious emails or text messages claiming to concern the incident, particularly those containing unfamiliar links, attachments or requests for personal information.

The watchmaker has not announced when the wishlist feature will return. It says further updates will be provided if its investigation uncovers additional information.