BigCommerce Data Breach via Ribon App Compromise

• •Compromised Ribon app credentials led to unauthorized access to customer data.
• •Data exposed includes names, emails, phone numbers, and addresses, but not payment info.
• •BigCommerce uninstalled the Ribon app on September 17 to prevent further access.

BigCommerce experienced a supply-chain breach due to compromised credentials of the Ribon app, affecting multiple online retailers. The breach occurred from September 13 to September 17, 2026, allowing unauthorized access to customer data, including names, email addresses, phone numbers, and physical addresses. Retailers such as Master of Malt confirmed that their customers' personally identifiable information (PII) was accessed. BigCommerce uninstalled the Ribon app from affected stores on September 17 to mitigate further risks. While passwords and payment information were reportedly not exposed, the incident raises concerns about potential phishing attacks targeting affected customers. The breach is classified as a supply-chain attack, emphasizing the vulnerability of third-party applications integrated into e-commerce platforms. BigCommerce has notified merchants and is cooperating with investigations, but the full scope of affected stores remains unclear.