Compromised Ribon apps exposed BigCommerce shoppers' names, emails, phone numbers and addresses
Attackers used stolen credentials for the Ribon apps on BigCommerce stores, 13 to 17 September, to take shoppers' names, emails, phones and addresses. Passwords and cards weren't included. Expect targeted phishing and texts, and don't act on unexpected messages.
If a shop you use on BigCommerce tells you your details were exposed, treat unexpected emails and texts that use your name, address or order details as suspect, and contact the shop through its own website. Nothing needs updating on your devices, and no password change is needed for this incident.
What’s happening
Between 13 and 17 September 2026, attackers used stolen credentials for Ribon and Ribon 1.5, two apps run by Be A Part Of, a Fastr brand, that plug into BigCommerce online stores. BigCommerce says the credentials were compromised through a Fastr system compromise, and that its own platform was not breached. Master of Malt, a UK spirits retailer, says the attacker downloaded customer records page by page until the key was revoked, taking full names, email addresses, phone numbers and postal addresses. BigCommerce says account passwords and payment card details are stored separately and were not included. It also says the credentials were used to inject malicious scripts into a small number of storefronts. BigCommerce removed the apps from affected stores on 17 September, told merchants and gave log data to the developer's investigation. Master of Malt told the UK Information Commissioner's Office and says the incident may reach hundreds of other stores. The number of stores and shoppers affected has not been disclosed. As of late September, Be A Part Of and Fastr had not publicly commented, and no root-cause report was found. No attacker group has been named.
- What
- Poisoned software
- Affects
- BigCommerce stores using the Ribon and Ribon 1.5 apps (Be A Part Of, a Fastr brand)
- Fixed in
- Nothing to patch
- Since
- 13 Sept 2026
- Closed
- 28 Sept 2026
Timeline
- UpdateNothing to patch
eSecurity Planet advised merchants to check what data their Ribon integration could reach, review logs and meet breach-notification duties. It gave no store count.
- UpdateNothing to patch
The Register reported that BigCommerce had not said how many merchants or shoppers were affected, how the key was stolen, or whether other apps were hit.
- UpdateNothing to patch
BleepingComputer reported that Master of Malt had told the UK Information Commissioner's Office and said the incident may reach hundreds of other stores. Be A Part Of and Fastr had not responded to requests for comment.
- UpdateNothing to patch
BigCommerce confirmed that API credentials for Ribon and Ribon 1.5 had been compromised through a Fastr system compromise. It uninstalled the apps from affected stores, revoked access and told the merchants involved.
- Made publicNothing to patch
Attackers began using stolen credentials for the Ribon and Ribon 1.5 BigCommerce apps to pull shopper records. Master of Malt says the access ran until 17 September.
Sources
- BigCommerce alerts merchants of data breach linked to Ribon appsBleepingComputer · 21 Sept 2026
- BigCommerce shopper data breach via Ribon app (The Register)The Register · 23 Sept 2026
- BigCommerce Data Breach: Third-Party App Compromise Exposes Customer DataeSecurity Planet · 28 Sept 2026
- Master of Malt technical incident noticeMaster of Malt · 21 Sept 2026
- BigCommerce data stolen via Ribon apps hackSecurityWeek · 22 Sept 2026