Awin has announced what it calls "confirmed breaches" tied to Honey, the PayPal-owned browser extension at the center of the affiliate industry's attribution dispute. The move makes Awin the latest affiliate network to formally update its stance on the extension, whose practice of swapping in its own affiliate tracking ID at checkout — commonly called "cookie stuffing" or last-click hijacking — has drawn scrutiny since a December 2024 YouTube investigation by MegaLag went viral.

For affiliates running rev-share and CPA deals through Awin, the phrase "confirmed breaches" matters more than any press-release framing. It signals the network has verified specific instances where Honey's behavior conflicted with its program terms, rather than relying on external reporting alone. That distinction is the difference between a vendor assertion and a measured finding, and it typically precedes enforcement action: publishers affected by overwritten cookies, advertisers paying commissions on traffic they did not receive, or both.

The context here is a widening industry response. Awin joins other affiliate networks that have already revised their positions on Honey in the months since the extension's tracking practices became public. The core allegation is straightforward: a shopper clicks an affiliate link, the publisher's cookie is set, and Honey then replaces that attribution with its own when the user reaches checkout — collecting the commission on CPS, CPL, and CPA conversions that a content site, coupon publisher, or cashback operator drove. Under last-click attribution, the extension wins by default because it interacts with the browser at the final step.

No network has published a full accounting of how much commission volume was redirected, and Awin's announcement, as reported by Performance Marketing World, does not specify the number of breaches confirmed, the advertisers affected, or whether publishers will see retroactive compensation. Those gaps deserve interrogation. Affiliates evaluating their exposure on hybrid or rev-share deals should watch for three concrete disclosures: the attribution window applied in the affected cases, the cookie duration Awin used to adjudicate claims, and any deadline for publishers to submit evidence of overwritten conversions.

There is also a compliance dimension. Advertisers that simultaneously ran Honey's own affiliate program while paying content publishers for the same sales were, in effect, double-funding acquisition on a subset of transactions — a conflict between program terms that few brands had reconciled before the story broke. Networks now updating their stances face pressure not only to police extensions but to clarify whose click earns the payout when two tagged interactions collide.

For publishers, the practical takeaway is narrower than the headlines suggest. Awin's confirmation validates what tracking audits had indicated, but recovery depends on the network's remediation process, not the breach finding itself. Affiliates with significant Awin volume should audit their own conversion data against extension-heavy traffic segments and document discrepancies before any claims window closes.

Expect further announcements from other networks and from PayPal, which has previously defended Honey's practices while reportedly adjusting some partner mechanics. Awin's "confirmed breaches" language raises the likelihood that the industry's response moves from policy statements to financial settlements.