Attackers Steal BigCommerce Customer Data Through Compromised Ribon App Credentials
Summary
Attackers used compromised Ribon app credentials from September 13–17 to access customer data in BigCommerce stores. BigCommerce says credentials were compromised through a Fastr system compromise and that malicious scripts affected a small number of storefronts.
Key points
- Attackers used a compromised BigCommerce application key held by Ribon between September 13 and September 17, 2026.
- Data accessed included customer names, email addresses, phone numbers, and physical addresses.
- Master of Malt reported that attackers downloaded data page by page until the key was revoked.
- BigCommerce confirmed credentials for Ribon and Ribon 1.5 were compromised due to a Fastr system compromise.
- BigCommerce said the credentials were used to inject malicious scripts into a small number of merchant storefronts.
- BigCommerce disabled the credentials, uninstalled the affected apps, notified merchants, and provided log data to support the developer’s investigation.
- The method of compromising Ribon and whether other entities were affected remain unclear; Be A Part Of and Fastr had not publicly acknowledged the incident.
Article Details
- Victim Organization
- BigCommerce
- Incident Type
- Supply chain attack involving compromised third-party application credentials and customer data theft; malicious scripts were also injected into some merchant storefronts.
- Incident Date
- 2026-09-13
- Disclosure Date
- 2026-09-18
- Data Types Exposed
- Names
- Email addresses
- Phone numbers
- Addresses
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Attackers used compromised Ribon application credentials to access and download customer data from BigCommerce stores between September 13 and September 17, 2026. BigCommerce said credentials were also used to inject malicious scripts into a small number of merchant storefronts. The credentials were revoked, affected Ribon applications were uninstalled, and merchants were notified.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Vendors
Products
Ribonmerchants that customer data was stolen after hackers compromised a BigCommerce application key held by Ribon, a storefront and shopping experience optimization app developed by Fastr-owned Be A Part Of.Ribon 1.517, 2026, Commerce confirmed that API credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by “Be A Part Of,” a Fastr company, had been compromised due to a Fastr system