E-commerce platform BigCommerce has alerted several retailers to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores.
The cloud-based Software-as-a-Service (SaaS) e-commerce platform confirmed the credentials compromise on September 17 and immediately removed the apps to protect its customers.
UK-based online spirits retailer Master of Malt is one of the BigCommerce customers who received the notification. The retailer said the attacker accessed customer information.
The hacker used the compromised credentials to access customer data in BigCommerce environments between September 13 and September 17, the company said.
In updates on the incident, Master of Malt says affected buyer information includes full names, email addresses, phone numbers and shipping addresses.
“It appears that hackers were able to compromise a BigCommerce application key held by Ribon that allowed them to gain access to customer data on their system.” Master of Malt explained.
BigCommerce supports over 1,200 third-party apps and integrations, including Ribon, an app from Be A Part Of, a Fastr brand that specializes in optimizing the shopping experience.
The e-commerce platform says it stores account passwords and payment card information separately and that this type of data has not been exposed.
In a statement to BleepingComputer, BigCommerce said the attacker compromised credentials for Ribon and Ribon 1.5 applications.
“On September 17, 2026, Commerce confirmed that credentials of the third-party applications Ribon and Ribon 1.5, owned and operated by Be A Part Of, a Fastr company, were compromised and used to inject malicious scripts into a small number of merchant stores.”
The company emphasized that neither its systems nor the BigCommerce platform were breached.
“In the best interest of our customers and their shoppers, we uninstalled the application at affected stores to revoke the attacker’s access, notified those merchants directly, and provided log data to assist in the developer’s investigation,” the company told BleepingComputer.
Master of Malt reported the incident to the UK’s Information Commissioner’s Office (ICO), noting that it could extend well beyond its own customers, potentially to hundreds of other stores.
Law firm Emery Reddy is seeking potential plaintiffs in connection with the incident and says several retailers are currently notifying customers about the disclosure of data related to the Ribon app key theft, without naming names.
BleepingComputer has contacted Be A Part Of and Fastr for further information on the incident, but we have not received a response at the time of publication.
The incident is similar to a breach against electronics accessories maker ZAGG in 2024, in which attackers manipulated the third-party FreshClick BigCommerce app and injected payment skimming code into its online store.
At the time, BigCommerce told BleepingComputer that its platform had not been hacked and removed the compromised app from customers’ stores.
But unlike the ZAGG incident, in which attackers captured payment information entered by customers during checkout, the Ribon attackers used a crafted application key to access existing customer records through BigCommerce.
