GoKawiilBigCommerce merchants hit after attackers hijack Ribon app credentials
BigCommerce confirmed that credentials for third-party Ribon and Ribon 1.5 apps, made by Fastr's Be A Part Of, were stolen and used to inject malicious scripts into a small number of merchant storefronts between September 13 and 17. UK retailer Master of Malt was among those affected, with attackers accessing customer names, emails, phone numbers, and shipping addresses, though passwords and payment data were not exposed. BigCommerce says its core platform and systems remained secure, and it disabled the compromised apps upon discovery.
GoKawiil's interpretation of the reporting above, not reported fact.
The breach shows how third-party app integrations can become a weak link even when a core SaaS platform's own security holds firm, exposing customer data across many independent storefronts at once. With BigCommerce supporting over 1,200 apps, the incident raises questions about how rigorously platform operators vet and monitor partner credentials.
- Attackers exploited stolen credentials for Ribon apps, not a BigCommerce platform flaw.
- Exposed data included customer names, emails, phone numbers, and addresses—not passwords or payment info.
- The breach highlights supply-chain risk from third-party app integrations on ecommerce platforms.
YubiKey 5C NFC Security Key — Breaches like this one often trace back to compromised credentials, and a hardware security key like the YubiKey 5C NFC adds a strong layer of protection beyond passwords alone. It's a simple way for both merchants and shoppers to guard important accounts against exactly this kind of credential theft. Plug-and-play support for major platforms makes it easy to start using right away.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-21
Published there as: “BigCommerce alerts merchants of data breach linked to Ribon apps”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.