Security notice – 17 October 2026
Updated 25 October 2026
We are investigating a security incident involving Swatch King, a third-party app supplied by StarApps and used on www.vibrams.co.uk.
What happened?
StarApps confirmed that an attacker added malicious code to our store’s app settings on 17 October. The code was designed to redirect shoppers attempting checkout to an external phishing website. Some versions could also pass shopping basket contents and page information to that website.
The potential exposure period began at approximately 4:54 pm on 17 October 2026. StarApps says the scripts stopped loading around 11:57 pm, with disabling confirmed by 12:30 am on 18 October. All times are UK time. The effect on already-open pages remains under investigation.
What information may have been affected?
We do not currently know which visitors were redirected or whether anyone entered personal or financial information on the external website. We have not confirmed theft of payment details.
What have we done?
StarApps reports that the malicious code has been removed. Shopify’s Account Security team is investigating, and we have notified the Information Commissioner’s Office.
We have directly contacted potentially affected shoppers we could identify. This public notice is intended to reach other visitors whose contact details we do not hold.
What should you do?
If you attempted checkout during this period:
• If you entered card or banking details on an unexpected checkout or verification page, contact your bank or card provider immediately through its official app or a trusted telephone number. Explain that your details may have been entered on a phishing website.
• If you entered a password on that page, change it on the genuine service and anywhere else you used the same password. Enable two-factor authentication where available.
• Monitor your transactions and be alert to unexpected payment, delivery or account-verification messages. Avoid links in suspicious messages.
Contact us
If you experienced an unexpected redirect, unusual payment request or related suspicious activity, please contact sales@barefootjunkie.com.
Please do not send full card details, security codes or passwords.
We are sorry for the concern this may cause. We will update this notice as material findings become available.
Dan Hume
Barefoot Junkie