NewsPublished 22 Sep 2026

BigCommerce Data Stolen via Ribon Apps Hack

Source SecurityWeek

Description

BigCommerce suffered a supply chain attack through a compromised application key belonging to the third-party app Ribon. Attackers used the stolen key to access customer data, including names, emails, phone numbers, and addresses, between September 13 and 17, 2026. The compromised key was revoked on September 17, and affected merchants were notified starting September 18. The incident was due to a compromise of the third-party app's credentials, not a breach of BigCommerce's own systems. BigCommerce uninstalled the Ribon app from affected stores to prevent further access.

Impact

Customer data including names, email addresses, phone numbers, and physical addresses were accessed and stolen from multiple BigCommerce merchant stores using the compromised Ribon application key. The attackers were able to download data page by page over several days. The incident affected merchants using the Ribon app, potentially exposing their customers to privacy risks and follow-on attacks such as phishing. There was no direct breach of BigCommerce's core platform or systems. The malicious activity was limited to stores where the Ribon app was installed and the compromised credentials were active.

Defensive guidance

BigCommerce revoked the compromised Ribon API credentials and uninstalled the Ribon application from affected merchant stores to prevent further unauthorized access. Merchants were notified of the incident and provided with log data to support investigation. Since the breach originated from a third-party app compromise, affected merchants should review their installed third-party applications and consider removing or replacing those with known security issues. Monitoring for suspicious activity related to customer data is advised. Patch status is not applicable as this is a credential compromise of a third-party app, not a software vulnerability. Check for any updates or advisories from Ribon or its parent company for further remediation guidance.

Summary

Attackers exploited a compromised API key belonging to the Ribon application, a third-party storefront optimization app installed on hundreds of BigCommerce merchant stores. Using this key, the attackers accessed and exfiltrated customer data from BigCommerce stores between September 13 and 17, 2026. The key was revoked and the Ribon app uninstalled after the compromise was detected. BigCommerce confirmed that the breach originated from a compromise of the third-party app's credentials due to a Fastr system compromise and not from a direct breach of BigCommerce's platform or systems. The attackers injected malicious scripts into some merchant storefronts via the compromised credentials. The full scope of the compromise of Ribon or other entities remains unclear, with no public acknowledgment from the app developer or parent company.

References

securityweek.com/bigcommerce-data-stolen-via-ribon-apps-hack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Sep 2026, 18:02 UTC

References

Community reviews