BigCommerce Merchants Suffer Data Breach via Ribon App Key Theft

Executive Summary

Leading Software-as-a-Service (SaaS) e-commerce provider BigCommerce has issued urgent notifications to online retailers following a third-party supply chain breach that exposed customer records and triggered malicious script injections across active storefronts. According to security advisories and merchant disclosures, attackers compromised API access credentials for Ribon and Ribon 1.5—popular store-optimization applications operated by Be A Part Of, a subsidiary of digital commerce provider Fastr.

The unauthorized activity commenced on September 13, 2026, when adversaries leveraged the compromised BigCommerce Application Keys to initiate unauthorized REST API requests into merchant environments. The intrusion persisted undetected until September 17, 2026, when BigCommerce security teams identified anomalous behavior, forcefully revoked the compromised credentials, and remotely uninstalled the Ribon applications across all affected merchant stores.

High-profile merchants, including UK-based online spirits retailer Master of Malt, have reported the security incident to the UK Information Commissioner's Office (ICO). Compromised customer records include full names, email addresses, phone numbers, and physical shipping addresses. BigCommerce stressed that its core platform infrastructure and primary databases remained unbreached, and that account passwords and payment card information (PCI) are stored in isolated cryptographic environments that were not accessed during the incident.

Technical Vulnerability Analysis & Attack Chain

The breach underscores the severe systemic risks inherent in modern e-commerce SaaS application ecosystems, where third-party marketplace integrations frequently hold expansive API access to merchant environments:

[Adversary Infiltrates Developer Environment (Be A Part Of / Fastr)]

│

▼

[Theft of Long-Lived BigCommerce Application OAuth / API Keys]

- Keys for 'Ribon' and 'Ribon 1.5' Shopping Optimization Apps Compromised

- Keys Contained Delegated Merchant Store Scopes

│

▼

[Automated API Reconnaissance & Data Harvesting (Sep 13 - Sep 17)]

- Adversary Initiates Direct REST API Calls to BigCommerce Merchant Tenants

- Queries Orders, Customers, and Shipping Endpoints:

GET /api/v2/customers

GET /api/v2/orders

- Exfiltrates Names, Email Addresses, Phone Numbers & Physical Delivery Addresses

│

▼

[Storefront Script Injection & DOM Tampering Attempt]

- Leverages App Script Manager Permissions (POST /v3/content/scripts)

- Injects Rogue Client-Side JavaScript into Live Merchant Storefronts

- Potential Magecart / Skimming Vector Prior to Revocation

│

▼

[Incident Discovery & Containment (September 17, 2026)]

- BigCommerce Security Detects Anomalous API Consumption Patterns

- Global Force-Uninstall of Ribon / Ribon 1.5 Across Merchant Ecosystem

- Revocation of Compromised Developer OAuth Tokens

1. The Anatomy of Third-Party SaaS Application Key Theft

BigCommerce supports more than 1,200 third-party applications in its ecosystem. Under the standard OAuth 2.0 authorization framework used by BigCommerce, merchants grant third-party applications granular or broad permissions (e.g., Manage Customers, Manage Orders, Manage Store Content) when installing an app from the marketplace.

The threat actors gained access to the proprietary developer keys for Ribon and Ribon 1.5 directly from the developer's infrastructure (Be A Part Of / Fastr). Armed with these authentic application credentials, the attackers did not need to exploit any software zero-days or breach BigCommerce's central cloud infrastructure:

1. API Impersonation: The stolen keys allowed the attackers to forge authenticated requests as the legitimate Ribon service.
2. Multi-Tenant Infiltration: Because the compromised application was installed across hundreds of commercial storefronts, the adversary gained delegated access to all merchant tenants where Ribon held active permissions.

2. Shopper Record Exfiltration via REST API

Between September 13 and September 17, 2026, the attackers systematically queried BigCommerce store management APIs. Utilizing endpoints such as /v2/customers and /v2/orders, they extracted database records encompassing:

• Full customer legal names
• Primary contact email addresses
• Verified phone numbers
• Physical delivery and shipping addresses

BigCommerce isolates authentication databases (salted and hashed passwords) and payment processing components (PCI-DSS tokenized card processing pipelines). Because payment cards are handled via hosted payment gateways or direct processor integrations, the API calls pulled only customer shipping and contact metadata.

3. Client-Side Script Injection Threats

In addition to API exfiltration, BigCommerce confirmed that the stolen credentials were used to inject malicious scripts into a subset of merchant storefronts. E-commerce applications often retain permissions to utilize BigCommerce's Script Manager API (/v3/content/scripts) to insert tracking pixels, chat widgets, and UX optimizers into store HTML.

By abusing these legitimate permissions, adversaries attempted client-side DOM tampering—a classic technique utilized by e-skimming and Magecart syndicates to capture credentials or manipulate client browsers. Prompt intervention by BigCommerce on September 17 purged the application and detached the injected scripts before widespread payment harvesting occurred.

Threat Actor Profile & Campaign Attribution

• Campaign Parallels (The 2024 ZAGG FreshClick Incident): This attack closely mirrors the 2024 breach of mobile accessory giant ZAGG, where threat actors compromised the third-party FreshClick BigCommerce app to inject payment-skimming code directly into checkout pages. In both instances, attackers targeted trusted marketplace developers rather than attempting direct attacks against hardened e-commerce cloud providers.
• Threat Actor Tradecraft: The adversary demonstrated operational familiarity with e-commerce SaaS architecture, targeting high-privilege marketplace developers to achieve massive downstream blast radius. The exfiltrated personal identity data is prime fuel for targeted phishing, credential stuffing, and executive spear-phishing campaigns.
• Affected Demographics: While UK spirits vendor Master of Malt was among the first to alert consumers, legal notices indicate that dozens to hundreds of global merchants utilizing Ribon tools may be impacted across North America and Europe.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Audit and Purge Compromised Applications:
  • Log into the BigCommerce Control Panel and navigate to Apps -> Manage My Apps.
  • Verify that Ribon and Ribon 1.5 are uninstalled.
  • Review all remaining third-party apps for unnecessary permissions, particularly those with access to customer lists or storefront script injection capabilities.
• Credential & API Key Rotation:
  • Immediately rotate all BigCommerce Store-Level API accounts, webhooks, and private API tokens generated for external services.
  • Revoke and re-issue any API secrets shared across multiple integration platforms.

2. Network & Perimeter Defenses

• Implement Strict Content Security Policy (CSP):
  • Enforce restrictive Content-Security-Policy headers on all e-commerce storefronts to prevent unauthorized external scripts from executing or exfiltrating data:

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.bigcommerce.com https://*.trustedpayments.com; connect-src 'self' https://api.bigcommerce.com; object-src 'none';

• Enable Subresource Integrity (SRI):
  • For all scripts loaded from external CDNs, mandate Subresource Integrity hashes to block tampered script execution in customer browsers.

3. Endpoint Detection & Hunting Query

BigCommerce API Audit Query: Detecting High-Volume Customer Endpoint Pulls

-- BigCommerce Access Log Analysis: Detecting automated customer data scraping

SELECT

timestamp,

client_ip,

request_method,

request_uri,

http_status,

user_agent,

oauth_client_id,

response_size_bytes

FROM bigcommerce_api_access_logs

WHERE request_uri LIKE '%/v2/customers%'

OR request_uri LIKE '%/v2/orders%'

AND timestamp BETWEEN '2026-09-13T00:00:00Z' AND '2026-09-17T23:59:59Z'

AND (response_size_bytes > 50000 OR http_status = 200)

ORDER BY response_size_bytes DESC;

Splunk Hunting Query: Outbound Storefront Script Callouts to Unrecognized Endpoints

index=web_proxy sourcetype=squid_access

| search uri_path="*/checkout*" OR uri_path="*/cart*"

| eval domain=replace(dest_host, "^[^.]*.", "")

| where NOT (domain IN ("bigcommerce.com", "paypal.com", "stripe.com", "google-analytics.com", "fastly.net"))

| stats count earliest(_time) as first_seen latest(_time) as last_seen values(uri) by src_ip, dest_host

| sort - count