On 17 September 2026, ecommerce platform BigCommerce confirmed that credentials belonging to the third-party apps Ribon and Ribon 1.5 had been compromised and used against a number of merchant stores. BigCommerce removed the apps from affected stores to cut off access. UK retailer Master of Malt, one of the merchants hit, said attackers had compromised "a BigCommerce Application key held by Ribon" and that shopper names and contact details were exposed.
The platform itself was not breached, according to BigCommerce. The access came through an app that merchants had installed and authorized.
What's affected
From BigCommerce's statement and merchant notices, as reported by BleepingComputer on 21 September:
- Apps: Ribon and Ribon 1.5, operated by Be A Part Of, a brand of Fastr.
- Window: Attacker access to shopper data ran from 13 to 17 September 2026.
- What the attacker did: BigCommerce said the compromised credentials were used to inject malicious scripts into "a small number of merchant storefronts." Master of Malt described the compromise of an application key held by Ribon.
- Data: Master of Malt said full names, email addresses, phone numbers and shipping postal addresses were affected. According to the BleepingComputer report, BigCommerce says it stores account passwords and payment card information separately and that this data was not exposed.
- Merchants: Master of Malt reported the incident to the UK Information Commissioner's Office and said the breach may extend to hundreds of other stores. Law firm Emery Reddy said several retailers were notifying customers without naming them.
- BigCommerce response: Uninstalled the app from affected stores to revoke the attacker's access, notified affected merchants and provided log data to support the app developer's investigation. It says its own systems and platform were not breached.
BleepingComputer contacted Be A Part Of and Fastr but had no response at publication.
BigCommerce supports more than 1,200 third-party apps and integrations, according to the same report. Each installed app holds credentials with whatever scopes the merchant approved at install time.
How to check if you're exposed
- Check your installed apps. In the BigCommerce control panel, open Apps, then My Apps. If Ribon or Ribon 1.5 was installed and is now gone, BigCommerce likely removed it and you should have a notice.
- List the scripts your storefront actually loads. Fetch your key pages and pull out every script source, then compare against a known-good list:
for path in / /cart.php /checkout /account.php; do
curl -s "https://www.yourstore.example$path" \
| grep -oE '<script[^>]*src="[^"]+"' | grep -oE 'src="[^"]+"'
done | sort -u > scripts-today.txt
diff scripts-baseline.txt scripts-today.txt
Also open Storefront, then Script Manager, in the control panel and review each entry. Pay attention to anything added or changed between 13 and 17 September, and to scripts with no clear owner.
- Review API accounts and app scopes. Under store-level API accounts, list every credential, what scopes it holds and whether it is still used. An app that only needs to read products should not hold customer scopes.
- Check outbound requests from checkout and account pages. Load your storefront with browser developer tools open and note every third-party domain contacted. Compare against your expected list.
What to do now
- Remove apps you no longer use. Every installed app is a credential with standing access to your store.
- Reduce scopes on the apps you keep. Reinstall or reconfigure apps that request customer or order scopes they do not need.
- Rotate store API credentials you control. If you created API accounts for agencies or integrations, rotate them now and delete unused ones.
- Set up script change monitoring. Run the storefront script diff above on a schedule and alert on any change. A daily diff shortens the time an injected script goes unnoticed.
- Add a Content Security Policy. Restricting which domains can serve scripts and receive data from your storefront limits what an injected script can do.
- Prepare customer notification. If you were affected, your customers' names, emails, phone numbers and addresses may be used in phishing that references their real orders.
Why it matters
Platform marketplaces make it easy to add features with one click, and each click grants a third party durable credentials into your store. When that third party's key is stolen, the attacker inherits whatever you approved.
BleepingComputer points to a 2024 case in which a different BigCommerce app was compromised to skim payment cards at checkout. This time, according to the reporting, the attacker went after existing customer records rather than card data. The pattern is the same: the weak point was an app, and merchants needed to know which apps they had and what those apps could touch.
Try it yourself
Run the storefront script diff above against your store and open the Script Manager in your control panel. For each script, write down who added it, why and whether it is still needed. Delete one you cannot justify.
Click through it at your own pace, or open it full screen.
Quick check
Was BigCommerce's platform breached?
BigCommerce says no. It says credentials belonging to the Ribon and Ribon 1.5 apps were compromised and used against a small number of merchant storefronts.
Was payment card data exposed?
According to BleepingComputer's report, BigCommerce says passwords and payment card information are stored separately and were not exposed. Merchants reported names, emails, phone numbers and shipping addresses.
How did BigCommerce cut off the attacker?
By uninstalling the Ribon apps from affected stores, which revoked the credentials the attacker was using.
