Ecommerce SaaS BigCommerce is in the Breaking ticker after confirming a third-party application credential compromise that reached merchant shopper records.
On September 17, 2026, BigCommerce confirmed that credentials belonging to Ribon and Ribon 1.5 — owned and operated by Be A Part Of, a Fastr company — had been compromised and used to inject malicious scripts into a small number of merchant storefronts. The company told BleepingComputer it uninstalled the apps from affected stores to revoke access, notified those merchants directly, and is providing log data to support the developer’s investigation. It underlined that BigCommerce systems / the platform were not breached.
UK spirits retailer Master of Malt, one notified merchant, said the attacker accessed shopper information in BigCommerce environments between September 13 and September 17. Impacted details it listed: full names, email addresses, phone numbers, and shipping postal addresses. Master of Malt said passwords and payment card data were stored separately and were not exposed, and that it reported the incident to the UK ICO. It also noted the blast radius may extend beyond its own customers — potentially to hundreds of other stores. Merchant and shopper counts remain Undisclosed beyond BigCommerce’s “small number” of storefronts phrasing.
POV: this is the familiar ecommerce integration path — steal a third-party app key, script a storefront, pull CRM-grade shopper rows — not a core platform root. Underwrite BigCommerce’s Sep 17 confirmation and Master of Malt’s field list; leave any “hundreds of stores” tally and Be A Part Of / Fastr root-cause details Undisclosed until they print them.