# Attackers Used Stolen Ribon App Credentials to Access Shopper Data

Between September 13 and 17, attackers used compromised credentials for the Ribon and Ribon 1.5 applications to access shopper information in BigCommerce merchant stores and inject malicious scripts into storefronts. BigCommerce confirmed the credential compromise on September 17 and immediately uninstalled the apps. The platform said its own systems were not breached. Affected merchants, including UK retailer Master of Malt, are notifying customers that names, email addresses, phone numbers and shipping addresses were exposed. BigCommerce stated that account passwords and payment card data are stored separately and were not accessed.

## Credential Compromise Timeline

BigCommerce reported that attackers compromised credentials for third-party applications Ribon and Ribon 1.5, both owned by Be A Part Of, a brand operated by Fastr. The attackers used those credentials to access shopper data in merchant stores between September 13 and September 17. BigCommerce discovered the compromise on September 17 and removed the apps from affected stores.

Master of Malt, one impacted retailer, said the exposed shopper details include full names, email addresses, phone numbers and shipping postal addresses. BigCommerce stated that account passwords and payment card information are stored separately and were not exposed.


## Third-Party Application Access

BigCommerce supports over 1,200 third-party applications and integrations. Ribon is a shopping-experience optimization tool operated by Be A Part Of. Once the credentials for Ribon were compromised, the attacker could access data from merchants who had installed the app.

BigCommerce emphasized that its platform and systems were not breached. The company said the entry point was the third-party developer's credentials, not the core infrastructure.


## Malicious Script Injection

Beyond accessing existing customer records, the attackers injected malicious scripts into a small number of merchant storefronts. BigCommerce did not specify what those scripts did.

This incident differs from a breach involving the FreshClick app on BigCommerce, where attackers injected payment-skimming code after compromising the app. In that case, the scripts captured card details as shoppers entered them. In the Ribon incident, the attacker used the compromised key to access existing shopper records.


## Merchant and Shopper Impact

BigCommerce notified affected merchants directly and provided server logs to support the developer's investigation. Master of Malt reported the incident to the UK Information Commissioner's Office and said the breach may extend to hundreds of other stores that used Ribon. Law firm Emery Reddy said several retailers are notifying customers about data exposure linked to the Ribon credential theft.

The exposed data does not include payment card numbers or passwords, but names, email addresses, phone numbers and shipping addresses can be used for phishing or account takeover attempts.


## Platform Security Clarification

BigCommerce clarified that its platform was not breached and that the compromise was limited to credentials held by the third-party developer. The company told BleepingComputer it acted in the best interest of customers and their shoppers by uninstalling the application to revoke the attacker's access.

BigCommerce said its systems store account passwords and payment card information separately. The company confirmed these sensitive data types were not exposed in this incident.


## Steps Merchants and Shoppers Can Take

If you run a BigCommerce store, check whether you received a notification from the platform. Review your list of installed apps and remove any that request broader permissions than needed. Rotate API credentials for apps that have access to customer data.

If you are a shopper, do not click links or download attachments in unsolicited emails that reference your order history or shipping address. Enable two-factor authentication on accounts tied to the email address exposed in this breach. Consider using a unique email alias for each online retailer to limit exposure in future breaches.
1. Check for a notification from BigCommerce if you run an affected store.
2. Review installed apps and remove those with excessive permissions.
3. Rotate API credentials for apps with access to customer data.
4. Enable two-factor authentication on accounts using exposed email addresses.
5. Use unique email aliases for different online retailers.

## Were payment card numbers stolen in the BigCommerce Ribon breach?

No. BigCommerce stated that account passwords and payment card information are stored separately and were not exposed. The compromised data includes shopper names, email addresses, phone numbers and shipping postal addresses.

## Which stores were affected by the Ribon credential theft?

BigCommerce has not published a complete list. Master of Malt is one confirmed victim, and the retailer said the breach may extend to hundreds of other stores. If you shopped at a BigCommerce store using Ribon between September 13 and 17, watch for a notification.

## Did attackers breach the BigCommerce platform itself?

No. BigCommerce confirmed that its platform and core systems were not breached. Attackers compromised credentials for the third-party Ribon and Ribon 1.5 applications, which gave them access to merchant data and the ability to inject scripts.

## What should I do if I receive a breach notification from a BigCommerce merchant?

Do not click links in the notification email; visit the retailer's website directly. Enable two-factor authentication on your account with that store and on other accounts using the same email address. Watch for phishing emails referencing your order history or shipping details.

## How can I reduce risk from third-party app breaches on ecommerce platforms?

Use a unique email alias and password for each online store. Enable payment alerts on your card for immediate notification of unauthorized transactions. If you run a store, review app permissions and remove integrations that request more access than their stated function requires.

Source: BleepingComputer
Published: 2026-09-22T01:25:54+00:00