Security notice: checkout issue, 17–19 October 2026

Last updated: 20/10/2026 - 14:36 BST

We want to tell you about a security issue involving third-party software used on our websites, part of a wider series of attacks on apps used by many online stores. It affected the checkout on our websites (gtomega.co.uk, gtomega.com and gtomega.eu). Below we explain what happened, what we have done about it, and what to do if you think you were affected.

We're terribly sorry that this has happened and we want you to know that we've taken the necessary steps to reduce the risk of it happening again.

What happened

For a limited period, some visitors who clicked a checkout button on our websites were sent to a fake checkout page instead of our real one. The fake page was designed to look like our checkout, showed the items in the visitor's basket, and asked for personal and card details.

The provider of our cookie banner has confirmed that the issue on its system began on the morning of Monday 19 October, and it was removed from our websites by 10:40 UK time that day. We have also received a report of the same behaviour on Saturday 17 October, which that provider's issue does not explain. We are investigating this with Shopify and our other software providers, so as a precaution this notice covers 17 to 19 October. We will update this page as we learn more.

It primarily affected visitors who had not previously answered our cookie banner, such as people visiting for the first time or browsing in a private window.

The fake page was on an unfamiliar web address, not one of our websites (gtomega.co.uk, gtomega.com or gtomega.eu).

Our real checkout was not changed or accessed. Orders placed and paid for on our genuine checkout were processed normally.

Why it happened

Like many online shops, we use a third-party app to show our cookie consent banner. A security flaw in that provider's system allowed an attacker to change the banner shown on a large number of online stores, including ours, and add hidden code to it. That code intercepted clicks on checkout buttons and redirected visitors to the fake page.

Similar attacks have affected a number of other apps used by online stores this month. We are checking whether a different app was responsible for the report from 17 October, and will update this page when we know more.

Our own systems, customer accounts and order records were not breached. However, anyone who entered details on the fake page may have given them to the attacker.

What has been done to stop it

As soon as we confirmed the cause on 19 October, we switched off the affected cookie banner on all of our websites.
The provider has closed the security flaw, removed the malicious code and restored the original banner on all affected stores.
We have tested our checkout on all three websites several times since 19 October. It is working normally and only sends customers to our genuine checkout, and we have received no further reports of the issue.
We have reported the incident to Shopify and contacted our other app providers to establish whether any other app on our websites was involved in the report from 17 October.

What is being done to prevent it happening again

The provider has changed its system so that banner changes can only be made by the store's own logged-in account, and so that the banner can no longer run code of any kind.
The provider is reviewing the rest of its system for similar flaws, and has told us it is appointing an independent cyber security firm to audit its systems, including penetration testing.
We are reviewing every third-party app that can display content on our websites, and have already removed ones we no longer use.
We have increased our regular checks of our live websites for unexpected code.

What to do if you think you were affected

You may have been affected if, around these dates, you clicked to check out with us and saw an unfamiliar checkout page, a page that kept loading, or a browser security warning, or if you entered card details but did not receive an order confirmation email from us.

If so, please:

Contact your bank or card provider straight away if you entered card details on a page you are unsure about. Ask them to cancel and replace your card.
Check your statements over the coming weeks for any payments you do not recognise, including small amounts, and report them to your bank.
Be wary of follow-up scams. We will never ask you for your card details, passwords or payment by email, phone, text or social media. Ignore any message claiming to offer a refund for this incident that asks for these details.
Contact us if you have questions or think you were affected (see below).

How to check your order is genuine: every genuine GT Omega order is followed by an order confirmation email from us with an order number. If you received one, your order was placed with us as normal. If you entered card details as well on any other page beforehand, please still follow the steps above.