Cybersecurity
BigCommerce alerts merchants after Ribon app compromise
BigCommerce said credentials for third-party Ribon applications were compromised and used to inject scripts into merchant stores, while Master of Malt said shopper details were accessed between 13 and 17 September.
- BigCommerce said credentials for the Ribon and Ribon 1.5 applications were compromised on 17 September 2026 and used to inject malicious scripts into a small number of merchant storefronts.
- The company said it removed the applications from affected stores, notified merchants directly and shared log data for the developer's investigation.
- Master of Malt said an attacker accessed shopper information in BigCommerce environments between 13 and 17 September.
- Master of Malt said exposed details could include full names, email addresses, phone numbers and shipping postal addresses, and it reported the incident to the UK Information Commissioner’s Office.
- BigCommerce said its own systems were not breached and that account passwords and payment card information were stored separately and were not exposed.
BigCommerce said on 17 September 2026 that credentials for the third-party applications Ribon and Ribon 1.5 had been compromised. It said those credentials were used to place malicious scripts into a small number of merchant storefronts.
The company said it removed the applications from affected stores, notified merchants directly and provided log data to support the developer's investigation. It also said its platform and systems were not breached.
Master of Malt said it was one of the merchants notified. The retailer said an attacker reached shopper data between 13 and 17 September, and that the exposed details may have included names, email addresses, phone numbers and shipping addresses.
Master of Malt said it had reported the incident to the UK Information Commissioner’s Office and that the issue could extend beyond its own customers to hundreds of other stores. Emery Reddy said it was seeking potential claimants linked to the incident.
The report compared the case with a 2024 incident involving ZAGG and the FreshClick BigCommerce app. In that earlier case, attackers injected payment-skimming code into an online store, while BigCommerce again said its platform was not breached.
Named in this story
Companies
- BigCommerce
- alerted merchants and said its platform was not breached
- Fastr
- owned the Be A Part Of brand
- Master of Malt
- said it received notice and that shopper data was accessed
- Emery Reddy
- said it was seeking potential claimants
- ZAGG
- was named in a similar 2024 incident
Organisations
- Be A Part Of
- operated the Ribon applications
Governments and agencies
- UK Information Commissioner’s Office
- received a report from Master of Malt
Products and systems
- Ribon
- one of the third-party applications whose credentials were compromised
- Ribon 1.5
- the second application named in the credential compromise
- FreshClick
- the BigCommerce app involved in that earlier incident
How the source tells it
The source was a straightforward incident report, with little emotive framing beyond routine urgency around notification and containment.
No emotive framing was found in the original.