Application Security · Incident Response
BigCommerce Customer Data Stolen Through Compromised Ribon App
Hackers accessed customer data from BigCommerce stores by exploiting a third-party app, Ribon. The breach affected stores using the app, exposing names, emails, phone numbers, and addresses.
Ross GrantUpdated 2 min read
The short version
Hackers stole customer data from online shops using BigCommerce by breaking into a third-party app called Ribon. The attackers used a stolen key to access names, emails, phone numbers, and addresses. BigCommerce removed the app from affected stores and notified merchants. Only stores using Ribon were affected, not all BigCommerce customers.
What happened?
Hackers accessed customer data from BigCommerce stores by exploiting a compromised application key from the third-party Ribon app. The breach occurred between 13 and 17 September 2026, exposing names, emails, phone numbers, and addresses. BigCommerce notified affected merchants after disabling the compromised app.
What happened to BigCommerce and its merchants
BigCommerce, a major platform for online shops, suffered a data breach after attackers compromised a third-party app called Ribon. Ribon is used by many merchants on BigCommerce to improve their storefronts. According to SecurityWeek (opens in a new tab), attackers got hold of an application key for Ribon and used it to access customer data from stores using the app. The breach took place between 13 and 17 September 2026. The attackers downloaded customer information, including names, email addresses, phone numbers, and physical addresses.
How the attack unfolded
The attackers exploited a compromised application key held by Ribon, which allowed them to access sensitive data from BigCommerce stores where Ribon was installed. Master of Malt, a UK-based spirits vendor affected by the breach, reported that the attackers worked "page by page" to download customer data until the key was revoked on 17 September. Ribon's developers became aware of the misuse a day before the key was disabled. BigCommerce started notifying affected merchants on 18 September, after uninstalling the Ribon app from impacted stores and revoking the compromised key.
What BigCommerce and others have said
BigCommerce confirmed to SecurityWeek that the credentials for Ribon and its variant, Ribon 1.5, were compromised due to a system breach at Fastr, the company behind Ribon. BigCommerce stressed that its own platform was not breached. Instead, the attack targeted the third-party app, which was independently installed by merchants. To limit harm, BigCommerce uninstalled the Ribon app from affected stores, notified merchants, and provided log data to help with investigations. As of now, neither Ribon's developer (Be A Part Of) nor its parent company Fastr have publicly commented on the incident.
Who is affected and what should you do?
The breach only affected merchants who had installed the Ribon app. Customers of these stores had their personal information exposed. If you are a merchant using BigCommerce, check whether you had Ribon installed and review any notifications from BigCommerce. Customers who have shopped at affected stores should watch for suspicious emails or phone calls, as attackers could use stolen data for phishing or scams.
What remains unclear
It is not yet clear how the attackers first compromised Ribon's credentials or whether other third-party apps were affected. Only SecurityWeek has reported on the incident so far, and further details may emerge if Ribon or Fastr issue statements or if more merchants share technical write-ups.
Claimed vs confirmed
- Confirmed
Hackers used a compromised Ribon app key to steal BigCommerce customer data.
BigCommerce confirmed the Ribon app credentials were compromised and used to access customer data.
- Confirmed
The breach was limited to stores with the Ribon app installed.
BigCommerce stated only merchants who installed Ribon were affected.
- Confirmed
The attackers injected malicious scripts into some merchant storefronts.
BigCommerce told SecurityWeek that the credentials were used to inject scripts into a small number of storefronts.
- Denied
The BigCommerce platform itself was breached.
BigCommerce said its own systems were not breached; only the third-party Ribon app was compromised.
The impact
- Money
- BigCommerce could face costs for incident response and possible regulatory scrutiny. Under UK and EU GDPR, fines for data breaches can reach up to £17.5 million or 4% of annual turnover, though no fine has been reported yet.
- Reputation
- The breach may damage trust in BigCommerce's app ecosystem, especially among merchants relying on third-party integrations. The company acted quickly to limit harm, which may help preserve its reputation.
- Customers
- Customers of affected stores had their personal details exposed. They should be alert for phishing attempts or scams using their stolen information.
Why it matters
This breach shows how third-party apps can become a weak point for online stores. Merchants and customers can be affected even if the main platform is secure. Personal data like names and contact details can be used for scams or phishing.
How does it work?
Attackers obtained a valid application key for the Ribon app, which allowed them to access customer data from BigCommerce stores where Ribon was installed. This is an example of a supply chain attack, where compromising a third-party component gives access to a larger system.
Key points
- Attackers stole customer data from BigCommerce stores by compromising the Ribon app.
- Only merchants using Ribon were affected, not all BigCommerce users.
- Personal information like names, emails, and addresses was exposed.
- BigCommerce acted by uninstalling the app and notifying affected merchants.
- The exact method of compromise and full scope are still unclear.
Sources
SecurityWeek
Reference
- BigCommerce Data Stolen via Ribon Apps Hack (opens in a new tab)
securityweek.com
- BigCommerce Data Stolen via Ribon Apps Hack (opens in a new tab)
