Breaches and incidentsBriefReported by a reputable outlet, citing the company
BigCommerce: Ribon app’s application key stolen and used to read shopper records and inject scripts on merchant stores
BigCommerce said credentials for the third-party “Ribon and Ribon 1.5” apps (Be A Part Of / Fastr) were compromised and used between 13 and 17 Sep to...
- Disclosed
What happened
- BigCommerce said credentials for the third-party “Ribon and Ribon 1.5” apps (Be A Part Of / Fastr) were compromised and used between 13 and 17 Sep to inject malicious scripts into “a small number of merchant storefronts” and access existing customer records (names, emails, phones, shipping addresses per Master of Malt). Passwords and card data are stored separately and were not exposed. BigCommerce says its own systems were not breached.
- Root cause: a BigCommerce application API key held by the Ribon app developer was compromised.
- No attacker named.
- Apps uninstalled from affected stores; merchants notified.
Sources
- https://www.bleepingcomputer.com/news/security/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps/
- https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-september-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.