On September 17, 2026, BigCommerce confirmed that credentials for third-party applications Ribon and Ribon 1.5, operated by Be A Part Of (a Fastr company), were compromised. Attackers used these credentials to inject malicious scripts into some merchant storefronts and accessed shopper data stored within BigCommerce environments. The compromised data included full names, email addresses, phone numbers, and shipping postal addresses. BigCommerce stated that its own systems and platform were not breached, and sensitive data such as account passwords and payment card information were stored separately and not exposed. The company removed the affected applications from stores to revoke attacker access and notified impacted merchants. One affected merchant, Master of Malt, reported the incident to the UK ICO and indicated the breach could affect many other stores. This incident resembles a 2024 breach involving another third-party BigCommerce app but differs in that the attackers accessed existing customer records rather than payment information entered during checkout.

Attackers gained unauthorized access to shopper personal information (names, emails, phone numbers, shipping addresses) from multiple BigCommerce merchants by compromising third-party application credentials. No payment card or account password data was exposed. The breach potentially affects hundreds of stores and their customers, leading to privacy risks and regulatory notifications. BigCommerce’s platform and core systems were not compromised.

BigCommerce removed the compromised Ribon and Ribon 1.5 applications from affected stores to revoke attacker access and notified impacted merchants directly. The platform operator is providing log data to support the developer's investigation. Merchants should follow BigCommerce’s guidance and monitor communications for further updates. No direct patch is applicable as this is a third-party app credential compromise. The platform itself was not breached.