Attackers exploited a compromised API key belonging to the Ribon application, a third-party storefront optimization app installed on hundreds of BigCommerce merchant stores. Using this key, the attackers accessed and exfiltrated customer data from BigCommerce stores between September 13 and 17, 2026. The key was revoked and the Ribon app uninstalled after the compromise was detected. BigCommerce confirmed that the breach originated from a compromise of the third-party app's credentials due to a Fastr system compromise and not from a direct breach of BigCommerce's platform or systems. The attackers injected malicious scripts into some merchant storefronts via the compromised credentials. The full scope of the compromise of Ribon or other entities remains unclear, with no public acknowledgment from the app developer or parent company.

Customer data including names, email addresses, phone numbers, and physical addresses were accessed and stolen from multiple BigCommerce merchant stores using the compromised Ribon application key. The attackers were able to download data page by page over several days. The incident affected merchants using the Ribon app, potentially exposing their customers to privacy risks and follow-on attacks such as phishing. There was no direct breach of BigCommerce's core platform or systems. The malicious activity was limited to stores where the Ribon app was installed and the compromised credentials were active.

BigCommerce revoked the compromised Ribon API credentials and uninstalled the Ribon application from affected merchant stores to prevent further unauthorized access. Merchants were notified of the incident and provided with log data to support investigation. Since the breach originated from a third-party app compromise, affected merchants should review their installed third-party applications and consider removing or replacing those with known security issues. Monitoring for suspicious activity related to customer data is advised. Patch status is not applicable as this is a credential compromise of a third-party app, not a software vulnerability. Check for any updates or advisories from Ribon or its parent company for further remediation guidance.