- BigCommerce confirms supply‑chain breach via compromised Ribon app credentials affecting merchant storefronts
- Master of Malt notified customers: names, emails, phone numbers, and addresses were exposed
- Attack ran Sept 13–17 2026; ICO notified, law firm warns of phishing risks for affected retailers
Ecommerce platform BigCommerce was recently hit with a cyberattack in which it lost sensitive data belonging to some of its users.
One of the users – online spirits retailer Master of Malt – confirmed the hit and notified its customers that their personally identifiable information (PII) was accessed in the attack.
BigCommerce is an ecommerce platform relatively similar to Shopify. Businesses use it to build and operate online stores without needing to develop the entire commerce infrastructure themselves. It offers features like storefronts, shopping carts, integrations with different payment providers, product inventories, SEO and marketing tools, and more.
The platform has been around since 2009 and according to a late 2024 SEC filing, serves 5,884 accounts with at least one unique enterprise plan subscription. A 2025 press release says BigCommerce is used by “tens of thousands of B2C and B2B companies across 150 countries.”
Software supply chain attack
BigCommerce allows its users to install, among others, a third-party app called Ribon, an ecommerce app providing tools that improve the online shopping experience. Some merchants integrate Ribon into their stores to add different functionality to the customer-facing storefront, and to optimize how visitors interact with different elements of their website. We don’t know exactly how many stores use Ribon.
According to Master of Malt, unidentified threat actors managed to compromise a BigCommerce Application key held by Ribon, and used it to access customer data that was held on their system. The attack took place on Sunday, September 13 2026, until the access was finally revoked four days later, on September 17.
Speaking to BleepingComputer, BigCommerce said credentials for Ribon and Ribon 1.5 were compromised:
“On September 17, 2026, Commerce confirmed that credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by ‘Be A Part Of,’ a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts,” the statement reads. “Acting in the best interest of our customers and their shoppers, we uninstalled the application from affected stores to revoke the attacker’s access, notified those merchants directly, and are providing log data to support the developer’s investigation,” the company told the publication.
The keyword in this statement is “small number of merchant storefronts.” BigCommerce hints that the attack was relatively small in scope and, consequently, in damage. However, in its report Master of Malt says otherwise:
“It’s now clear that we weren’t the target of the attack. The attack was against Ribon, which was installed on hundreds of BigCommerce stores. Once the attackers compromised an access key from Ribon, they used it to access data held inside BigCommerce.”
Names and emails
Whether or not this transforms into a new Snowflake fiasco remains to be seen.
In the meantime, Master of Malt also said BigCommerce notified it that the attack had been stopped and that there was no further risk of compromise. All companies affected by the breach were contacted. As for the spirits retailer, here is what it said about the data exposed in the hit:
“I’m sorry to say that the attackers had access to your name, email address, phone number, and address. However, they were not able to access your password, credit card or other payment information as they are held in a separate system which was never compromised.”
Master of Malt reported the attack to the UK Information Commissioner’s Office (ICO). Law firm Emery Reddy is calling for potential claimants to the incidents, saying that “several retailers” are currently notifying customers about data exposure related to the incident, BleepingComputer reported.
“A number of online retailers that use the BigCommerce e-commerce platform have begun notifying customers of a data breach that originated not with the retailers themselves, but with a third-party application called Ribon,” the law firm says. Emery Reddy also warned of potential phishing and scam attacks.
Go to Source
Sead Fadilpašić
