BigCommerce merchants breached through compromised Ribon third-party app credentials
BigCommerce has begun notifying merchants this week, and any store that had a Ribon app connected during September 13-17 may still be serving injected skimmer script to checkout pages and still holds live app API credentials that were in the attacker's hands.
Attackers obtained credentials for third-party Ribon applications installed on BigCommerce stores and used them to reach merchant environments and inject malicious scripts into storefronts. BigCommerce confirmed the credential compromise on September 17, removed the apps, and notified affected merchants; access to shopper data occurred between September 13 and September 17, with at least one merchant (Master of Malt) confirming shopper details were accessed.
Affected: BigCommerce stores with Ribon third-party applications connected (access window 2026-09-13 to 2026-09-17)
How to Test
In the BigCommerce control panel, list installed/authorized apps and API accounts and check whether any Ribon app was connected; review store audit logs and API account activity for requests between September 13 and September 17, 2026, and diff theme files, script manager entries and checkout pages for unrecognized JavaScript or external script tags added in that window. Also check for any BigCommerce breach notification e-mail to the store owner address.
How to Mitigate
Uninstall the Ribon apps, revoke and reissue every BigCommerce API account token and OAuth grant the store holds, remove any injected script manager entries or theme code, reset staff/control-panel passwords and enforce MFA, then assess whether shopper records accessed in the window require customer notification.