Enterprise e-commerce platform BigCommerce fell victim to a supply chain attack that resulted in the theft of customer data.
BigCommerce is a SaaS provider that enables merchants to build and manage online stores. It hosts the stores, provides backend tools and takes care of server security.
Late last week, the company began notifying retailers that customer data had been stolen after hackers compromised a BigCommerce application key for Ribon, a storefront and shopping experience optimization app developed by Fastr-owned Be A Part Of.
The hackers used the key between September 13 and September 17 to access customer data, including names, email addresses, phone numbers and addresses, British liquor retailer Master of Malt noted in a report technical description.
According to Master of Malt, the hackers downloaded customer data “page by page” until the compromised key was revoked on September 17, a day after Ribon developers learned of its misuse.
BigCommerce began notifying merchants of the incident on September 18 after deactivating the key and uninstalling the Ribon applications in question.
“The attack targeted Ribon, which was installed in hundreds of BigCommerce stores. After the attackers compromised a Ribon access key, they used it to access data stored in BigCommerce,” said Master of Malt.
BigCommerce, which supports over 1,200 third-party applications, has confirmed that the hackers compromised the Ribon application credentials.
“On September 17, 2026, Commerce confirmed that API credentials of the third-party applications Ribon and Ribon 1.5, owned and operated by “Be A Part Of,” a Fastr company, were compromised due to a compromise of the Fastr system. The credentials were used to inject malicious scripts into a small number of merchant shops. This was not a breach of Commerce systems or the BigCommerce platform,” BigCommerce told SecurityWeek.
“While the Ribon applications are third-party apps that are installed independently by the merchant and where the relationship is between the merchant and the third-party application, Commerce has acted in the best interests of our customers and their shoppers by uninstalling the application from the affected stores to remove the attacker’s access and limit the damage, directly notify affected merchants, and provide log data to support the developer’s own investigation,” the company added.
It is unclear how Ribon was compromised and whether other companies were also affected, as neither Be A Part Of nor Fastr have publicly acknowledged the incident.
Safety Week has emailed both companies for more information and will update this article if they respond.
Related: CrowdSec confirms source code theft in a supply chain attack
Related: 23 million user records compromised in Gyazo data breach
Related: Revolut data breach: 5 months, 680 high-profile accounts, $3 million ransom
Related: First agent AI data breach reported to Spanish regulator
