BigCommerce Merchants Alerted After Ribon App Credentials Exposed Shopper Data
Summary
Attackers used compromised Ribon app credentials to access shopper data and inject scripts into a small number of BigCommerce stores. Master of Malt reported exposed customer details; BigCommerce said its platform and payment data were not breached.
Key points
- BigCommerce said credentials for the third-party Ribon and Ribon 1.5 apps were compromised and confirmed the incident on September 17, 2026.
- The credentials were used to access shopper data in BigCommerce environments between September 13 and 17 and inject malicious scripts into a small number of merchant storefronts.
- Master of Malt said exposed shopper details included names, email addresses, phone numbers, and shipping addresses.
- BigCommerce said it removed the affected apps, notified impacted merchants, and provided log data to support the developer’s investigation.
- BigCommerce said its platform and stored payment card data were not breached.
- Master of Malt reported the incident to the UK Information Commissioner’s Office and said it may affect other stores.
Article Details
- Victim Organization
- Master of Malt
- Incident Type
- Compromised third-party application credentials were used to access shopper data and inject malicious scripts into a small number of merchant storefronts.
- Disclosure Date
- 2026-09-17
- Data Types Exposed
- Full names
- Email addresses
- Phone numbers
- Shipping postal addresses
- Operational Impact
- BigCommerce removed the affected Ribon applications from impacted stores, notified merchants, and provided log data to support the developer's investigation. BigCommerce said its platform and stored payment card data were not breached.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Vendors
Products
RibonBigCommerce notified merchants that attackers compromised credentials for the third-party Ribon and Ribon 1.5 applications and used them to inject malicious scripts into a small number of storefronts.Ribon 1.5BigCommerce notified merchants that attackers compromised credentials for the third-party Ribon and Ribon 1.5 applications and used them to inject malicious scripts into a small number of storefronts.