BreachPublished 21 Sep 2026

BigCommerce alerts merchants of data breach linked to Ribon apps

Source Bleeping Computer

Description

BigCommerce alerted merchants to a data breach involving compromised credentials of third-party Ribon applications. Attackers used these credentials to inject malicious scripts and access shopper data, including names, emails, phone numbers, and shipping addresses. Payment card information and account passwords were not exposed. The breach affected multiple merchants between September 13 and 17, 2026. BigCommerce removed the compromised apps and revoked attacker access. The platform itself was not breached. The incident may impact hundreds of stores and is under investigation.

Impact

Attackers gained unauthorized access to shopper personal information (names, emails, phone numbers, shipping addresses) from multiple BigCommerce merchants by compromising third-party application credentials. No payment card or account password data was exposed. The breach potentially affects hundreds of stores and their customers, leading to privacy risks and regulatory notifications. BigCommerce’s platform and core systems were not compromised.

Defensive guidance

BigCommerce removed the compromised Ribon and Ribon 1.5 applications from affected stores to revoke attacker access and notified impacted merchants directly. The platform operator is providing log data to support the developer's investigation. Merchants should follow BigCommerce’s guidance and monitor communications for further updates. No direct patch is applicable as this is a third-party app credential compromise. The platform itself was not breached.

References

bleepingcomputer.com/news/security/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Sep 2026, 21:46 UTC

References

Community reviews