{"id":"ribon-bigcommerce-app-credential-theft-sep-2026","category":"supply-chain","status":"closed","title":"Compromised Ribon apps exposed BigCommerce shoppers' names, emails, phone numbers and addresses","tldr":"Attackers used stolen credentials for the Ribon apps on BigCommerce stores, 13 to 17 September, to take shoppers' names, emails, phones and addresses. Passwords and cards weren't included. Expect targeted phishing and texts, and don't act on unexpected messages.","summary":"Between 13 and 17 September 2026, attackers used stolen credentials for Ribon and Ribon 1.5, two apps run by Be A Part Of, a Fastr brand, that plug into BigCommerce online stores. BigCommerce says the credentials were compromised through a Fastr system compromise, and that its own platform was not breached. Master of Malt, a UK spirits retailer, says the attacker downloaded customer records page by page until the key was revoked, taking full names, email addresses, phone numbers and postal addresses. BigCommerce says account passwords and payment card details are stored separately and were not included. It also says the credentials were used to inject malicious scripts into a small number of storefronts. BigCommerce removed the apps from affected stores on 17 September, told merchants and gave log data to the developer's investigation. Master of Malt told the UK Information Commissioner's Office and says the incident may reach hundreds of other stores. The number of stores and shoppers affected has not been disclosed. As of late September, Be A Part Of and Fastr had not publicly commented, and no root-cause report was found. No attacker group has been named.","action":"If a shop you use on BigCommerce tells you your details were exposed, treat unexpected emails and texts that use your name, address or order details as suspect, and contact the shop through its own website. Nothing needs updating on your devices, and no password change is needed for this incident.","product":"BigCommerce stores using the Ribon and Ribon 1.5 apps (Be A Part Of, a Fastr brand)","audience":"both","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["bigcommerce","ribon","fastr","supply-chain","data-breach","ecommerce","third-party-app","phishing-risk"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"BigCommerce alerts merchants of data breach linked to Ribon apps","url":"https://www.bleepingcomputer.com/news/security/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps/","by":"BleepingComputer","date":"2026-09-21"},{"kind":"news","title":"BigCommerce shopper data breach via Ribon app (The Register)","url":"https://www.theregister.com/a/5298377","by":"The Register","date":"2026-09-23"},{"kind":"news","title":"BigCommerce Data Breach: Third-Party App Compromise Exposes Customer Data","url":"https://www.esecurityplanet.com/news/news-bigcommerce-ribon-customer-data-exposure/","by":"eSecurity Planet","date":"2026-09-28"},{"kind":"post","title":"Master of Malt technical incident notice","url":"https://www.masterofmalt.com/sorry/technical/","by":"Master of Malt","date":"2026-09-21"},{"kind":"news","title":"BigCommerce data stolen via Ribon apps hack","url":"https://www.securityweek.com/bigcommerce-data-stolen-via-ribon-apps-hack/","by":"SecurityWeek","date":"2026-09-22"}],"started":"2026-09-13","closed":"2026-09-28","created":"2026-11-03T21:27:51.861Z","updated":"2026-11-03T21:27:51.861Z","cve_notes":[],"timeline":[{"at":"2026-09-28","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"eSecurity Planet advised merchants to check what data their Ribon integration could reach, review logs and meet breach-notification duties. It gave no store count.","url":"https://www.esecurityplanet.com/news/news-bigcommerce-ribon-customer-data-exposure/","by":"eSecurity Planet","patch":"na"},{"at":"2026-09-23","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"The Register reported that BigCommerce had not said how many merchants or shoppers were affected, how the key was stolen, or whether other apps were hit.","url":"https://www.theregister.com/a/5298377","by":"The Register","patch":"na"},{"at":"2026-09-21","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"BleepingComputer reported that Master of Malt had told the UK Information Commissioner's Office and said the incident may reach hundreds of other stores. Be A Part Of and Fastr had not responded to requests for comment.","url":"https://www.bleepingcomputer.com/news/security/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps/","by":"BleepingComputer","patch":"na"},{"at":"2026-09-17","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"BigCommerce confirmed that API credentials for Ribon and Ribon 1.5 had been compromised through a Fastr system compromise. It uninstalled the apps from affected stores, revoked access and told the merchants involved.","url":"https://www.theregister.com/a/5298377","by":"The Register","patch":"na"},{"at":"2026-09-13","added":"2026-11-03T21:23:52.346Z","kind":"disclosed","text":"Attackers began using stolen credentials for the Ribon and Ribon 1.5 BigCommerce apps to pull shopper records. Master of Malt says the access ran until 17 September.","url":"https://www.bleepingcomputer.com/news/security/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps/","by":"BleepingComputer","patch":"na"}],"url":"https://hard.fyi/live/ribon-bigcommerce-app-credential-theft-sep-2026/","json":"https://hard.fyi/api/live?id=ribon-bigcommerce-app-credential-theft-sep-2026"}