What happened

Heads up: some BigCommerce stores had a bad week. Attackers got their hands on the credentials for a third-party tool called Ribon (and Ribon 1.5), then used those keys to sneak into a handful of merchant accounts and pull out customer records. The platform confirmed the compromise on September 17, 2026 and removed the offending apps to cut off the intruders.

One affected merchant, a UK retailer, reported the intruders accessed customer information between September 13 and September 17. The exposed fields include:

  • Full names
  • Email addresses
  • Phone numbers
  • Shipping/postal addresses

BigCommerce says its own platform systems were not breached and that account passwords and payment card data are stored separately — according to the company, those payment details were not harvested in this incident. The attacker relied on a compromised app key to read existing records via the app’s access, not by tampering with checkout payment flows.

Why this matters (and what to do about it)

If you run an online store, this is a reminder that third-party add-ons are tiny trust rockets: great when they work, catastrophic if they get hijacked. This event echoes past cases where rogue apps were abused to steal data, although the mechanics can differ — sometimes attackers skim payments during checkout, other times they read stored customer records like here.

Practical steps for merchants and devs — quick checklist:

  • Audit installed apps and remove any you don’t actively use.
  • Rotate API keys and credentials for third-party integrations immediately.
  • Review access scopes: make sure apps only have the permissions they truly need.
  • Check your logs for unusual API access during the affected dates.
  • Notify customers if their shopper contact details may have been exposed and advise on phishing risks.
  • Report the incident to your regulator if required and preserve logs for investigators or legal counsel.

BigCommerce removed the apps from affected stores and shared logs with the app developer to help with the investigation. Law firms may start reaching out to potentially impacted merchants — if you’ve been notified, keep records and consider seeking legal advice.

Final thought: third-party convenience comes with responsibility. Keep those app permissions tight, rotate keys like you rotate your passwords, and always assume the worst so you can act fast when the unexpected happens.