BigCommerce Warns Merchants of Data Breach Tied to Ribon Apps

How Ribon App Credentials Were Exploited

Ecommerce platform BigCommerce has notified several merchants of data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores. The incident occurred in September 2026 and was identified through security monitoring systems that detected unauthorized access attempts. BigCommerce confirmed the breach stemmed from exposed login details rather than a vulnerability in its own infrastructure.

Attackers gained access to Ribon app accounts using stolen or leaked credentials, allowing them to modify storefront code and insert harmful scripts designed to skim payment information. These scripts operated covertly, capturing customer data during checkout without triggering immediate alerts. BigCommerce stated that no core platform systems were compromised and emphasized that the breach was isolated to specific third-party integrations. Merchants were advised to audit their installed apps and review access logs for suspicious activity.

What Steps Should Merchants Take Now?

The attackers likely obtained Ribon login information through phishing campaigns, credential stuffing, or data leaks from unrelated services. Once inside, they leveraged the apps’ permissions to alter theme files and inject JavaScript snippets that transmitted sensitive data to external servers. Security analysts noted that the malicious code was obfuscated to evade detection by standard security scans. BigCommerce has since worked with affected merchants to remove the scripts and reset compromised credentials.

Merchants using Ribon or similar third-party apps should immediately rotate all API keys and passwords associated with those services. They should also enable multi-factor authentication where available and review app permissions to ensure only necessary access is granted. BigCommerce recommends conducting a full security audit of storefront code and monitoring transaction logs for unusual patterns. The platform has offered free security consultations to impacted businesses as part of its response.

Was the BigCommerce platform itself hacked? No, the breach resulted from compromised third-party app credentials, not a vulnerability in BigCommerce’s core systems.

Frequently Asked Questions

How can merchants tell if their store was affected? Signs include unexpected changes to storefront code, unfamiliar scripts in page headers, or alerts from security tools about data exfiltration attempts.

Is customer data still at risk? If malicious scripts have been removed and credentials reset, the immediate threat is neutralized, but merchants should monitor for signs of misuse.