BigCommerce warns merchants of breach tied to Ribon apps

Ecommerce platform BigCommerce has notified a number of merchants that their data may have been exposed. Attackers compromised credentials for the third-party Ribon applications and used them to inject malicious scripts into online stores.

The cloud-based SaaS provider confirmed the credential compromise on September 17 and immediately removed the apps to protect its customers. According to the company, the attackers had access to shopper data in BigCommerce environments between September 13 and September 17.

What was exposed

One of the affected merchants is UK-based spirits vendor Master of Malt. It says the attacker accessed shopper information — full names, email addresses, phone numbers and shipping postal addresses. The retailer believes the hackers compromised a BigCommerce application key held by Ribon and used it to reach customer data on the system.

BigCommerce stresses that account passwords and payment card details are stored separately and were not exposed. The company insists that neither its systems nor the platform itself were breached.

Ribon is one of more than 1,200 third-party apps and integrations on the platform. It is operated by Be A Part Of, a brand within Fastr that specializes in shopping-experience optimization. In a statement to BleepingComputer, BigCommerce clarified that credentials for both the Ribon and Ribon 1.5 applications had been compromised.

Scope and fallout

In response, the platform uninstalled the application from affected stores to revoke the attacker's access, notified the merchants directly, and handed log data to the developer for its investigation. Master of Malt reported the incident to the UK's Information Commissioner's Office and warns it may extend to hundreds of other stores. Law firm Emery Reddy is already seeking potential claimants, noting that several retailers are notifying their customers.

The case echoes a 2024 breach at accessory maker ZAGG, where attackers compromised the third-party FreshClick app and injected payment-skimming code into the store. There is a difference, though: whereas the ZAGG attackers captured card data at checkout, the Ribon attackers used a stolen application key to pull existing customer records through BigCommerce.

Be A Part Of and Fastr had not responded to the outlet's inquiries by publication time.

Source: Bleeping Computer