BigCommerce has confirmed that credentials belonging to Ribon and Ribon 1.5, third-party apps installed on merchant storefronts, were compromised and used to inject malicious scripts into what it calls "a small number of merchant storefronts." The activity ran from September 13 to September 17, 2026. UK spirits retailer Master of Malt has told customers that their names, email addresses, phone numbers and addresses were accessed. The total number of affected merchants and shoppers has not been disclosed.
Ribon is a storefront optimization app operated by Be A Part Of, a Fastr company. According to BigCommerce's statement, reported by BleepingComputer, the app's credentials were compromised and used to inject malicious scripts into merchant storefronts. BigCommerce says it confirmed the compromise on September 17, uninstalled the affected apps from merchant stores to cut off access, and shared log data to support the developer's investigation. It began notifying affected merchants on September 18, according to SecurityWeek.
BigCommerce states that "this was not a breach of Commerce systems or the BigCommerce platform." Master of Malt's customer notice, as reported by GBHackers, describes a BigCommerce application key held by Ribon that was used to access customer information stored in BigCommerce. SecurityWeek reports the data was downloaded page by page. The incident date used for this report is September 13, the start of the access window given by BigCommerce.
Master of Malt has reported the incident to the UK Information Commissioner's Office. Be A Part Of and Fastr have not commented publicly. No group has claimed responsibility.
The only merchant-level disclosure so far comes from Master of Malt, which told customers that attackers had access to their names, email addresses, phone numbers and physical addresses. The retailer says passwords, card details and other payment information were not exposed because they are stored in a separate system that was not breached. What was taken from other affected stores has not been disclosed.
The population is not yet known. BigCommerce describes the impact as limited to a small number of storefronts, while Master of Malt noted that Ribon is installed on hundreds of BigCommerce stores. Being installed on a store is not the same as being affected, and neither company has given a count of merchants or shoppers.
The platform held and the merchant's own systems held, yet customer data still left through a credential that neither of them issued to a person. Commerce apps are routinely granted standing API access to customer records and permission to add scripts to live storefronts. That access sits with the app vendor, is rarely reviewed after installation, and usually stays in place long after anyone remembers why the app was added. When the vendor's key is stolen, the attacker inherits every permission the merchant approved.
For retailers and any business running a hosted storefront, the question to ask this week is: which installed apps can read customer data or change the scripts on our pages, who owns each one, and would we notice if one of them started exporting records in bulk? Useful controls include pruning unused apps, limiting each app to the smallest permission set it needs, inventorying the scripts that load on checkout and account pages, and alerting on unusual API export volumes. This is third-party access governance, and it belongs in the same review cycle as privileged accounts.
How many merchants and shoppers were affected, how the Ribon credentials were compromised, what the injected scripts did on affected storefronts, whether any regulator outside the UK has been notified, and whether other BigCommerce apps were targeted.
1. BigCommerce alerts merchants of data breach linked to Ribon apps, BleepingComputer, September 21, 2026. BigCommerce statement on compromised Ribon and Ribon 1.5 credentials, script injection, access window, removal of apps and that its platform was not breached; Master of Malt data types.
2. BigCommerce Data Stolen via Ribon Apps Hack, SecurityWeek, September 22, 2026. Timeline including merchant notification from September 18, page-by-page download of customer data, no public comment from Be A Part Of or Fastr.
3. BigCommerce warns customers of potential data leaks following cyber incident, TechRadar, September 22, 2026. Master of Malt customer notice, Ribon installed on hundreds of BigCommerce stores, report to the UK ICO.
4. Hackers abuse stolen BigCommerce app key to steal Master of Malt customer data, GBHackers, September 22, 2026. Master of Malt description of the Ribon application key used to access customer information; data not exposed.
