BigCommerce warns customers of potential data leaks following cyber incident

BigCommerce confirms supply‑chain breach via compromised Ribon app credentials affecting merchant storefronts Master of Malt notified customers: names, emails, phone numbers, and addresses were exposed Attack ran Sept 13–17 2026; ICO notified, law firm warns of phishing risks for affected retailers Ecommerce platform BigCommerce was recently hit with a cyberattack in which it lost sensitive data belonging to some of its users.

One of the users - online spirits retailer Master of Malt - confirmed the hit and notified its customers that their personally identifiable information (PII) was accessed in the attack.

BigCommerce is an ecommerce platform relatively similar to Shopify.

Businesses use it to build and operate online stores without needing to develop the entire commerce infrastructure themselves.

It offers features like storefronts, shopping carts, integrations with different payment providers, product inventories, SEO and marketing tools, and more.

The platform has been around since 2009 and according to a late 2024 SEC filing , serves 5,884 accounts with at least one unique enterprise plan subscription.

A 2025 press release says BigCommerce is used by “tens of thousands of B2C and B2B companies across 150 countries.” Software supply chain attack BigCommerce allows its users to install, among others, a third-party app called Ribon, an ecommerce app providing tools that improve the online shopping experience.

Some merchants integrate Ribon into their stores to add different functionality to the customer-facing storefront, and to optimize how visitors interact with different elements of their website.

We don’t know exactly how many stores use Ribon.

According to Master of Malt, unidentified threat actors managed to compromise a BigCommerce Application key held by Ribon, and used it to access customer data that was held on their system.

The attack took place on Sunday, September 13 2026, until the access was finally revoked four days later, on September 17.

Speaking to BleepingComputer , BigCommerce said credentials for Ribon and Ribon 1.5 were compromised: "On September 17, 2026, Commerce confirmed that credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by 'Be A Part Of,' a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts,” the statement reads.

"Acting in the best interest of our customers and their shoppers, we uninstalled the application from affected stores to revoke the attacker's access, notified those merchants directly, and are providing log data to support the developer's investigation," the company told the publication.