# BigCommerce Merchant Storefronts Compromised via Stolen Ribon App Credentials, Malicious Script Injection

> Attackers stole a BigCommerce application access key belonging to the third-party storefront-optimization apps Ribon and Ribon 1.5 (operated by Be A Part Of, a Fastr company) and used it to access customer data and inject malicious scripts across BigCommerce merchant storefronts between September 13-17, 2026. BigCommerce revoked the key and removed the apps platform-wide; confirmed victim Master of Malt (UK) had customer names, emails, phone numbers, and shipping addresses exposed, with passwords and payment data unaffected.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2610
- **ID:** TL-2026-2610
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between Sunday, September 13, 2026 and Thursday, September 17, 2026, attackers obtained and abused a stolen BigCommerce application access key belonging to Ribon and Ribon 1.5, third-party storefront-optimization apps operated by Be A Part Of, a Fastr company, and distributed through the BigCommerce App Marketplace. Because the apps run with elevated, trusted API scopes granted by every merchant who installs them, the stolen token gave the attackers a single credential that fanned out across the customer data of every BigCommerce storefront running Ribon or Ribon 1.5 -- a textbook trusted-relationship / software-supply-chain compromise rather than a vulnerability in BigCommerce's own platform.

Reporting on the incident describes two related effects of the compromise: attackers used the stolen key to pull customer records directly from data stored on Ribon's backend systems, and separately, malicious scripts were injected into affected online stores. BigCommerce has stated its own platform and systems were not breached; the compromise originated entirely within the third-party vendor's application and credential handling.

On September 17, 2026, BigCommerce's security team identified the abuse, revoked the compromised access key, and uninstalled Ribon and Ribon 1.5 from every affected merchant storefront. BigCommerce notified impacted merchants directly and supplied log data to support their own investigations. Individual retailers then began notifying their own customers; UK online spirits retailer Master of Malt is the first confirmed victim, disclosing that unauthorized parties accessed customers' full names, email addresses, phone numbers, and postal addresses. Master of Malt and BigCommerce both state that account passwords and payment card data were held in separate systems and were not exposed, and Master of Malt has stated the breach is contained with no ongoing unauthorized access. Notably, Emery | Reddy's own breach-litigation intake page states that it has not independently verified retailers' claim that passwords and payment data sat in a separate, unaffected system -- that segregation claim currently rests solely on statements from BigCommerce and the retailers themselves. Master of Malt reported the incident to the UK Information Commissioner's Office (ICO). Because Ribon and Ribon 1.5 were installed on every BigCommerce storefront that used them -- not just Master of Malt's -- multiple retailers beyond Master of Malt are expected to disclose the same underlying incident to their own customers; Emery | Reddy is soliciting affected customers across retailers for potential breach litigation. The malicious storefront scripts persisted in place, embedded via the apps' legitimate extensibility/integration mechanism into each merchant's live storefront pages, for the duration of the September 13-17, 2026 window until BigCommerce forcibly uninstalled Ribon and Ribon 1.5 platform-wide -- the removal, not detection by the merchants themselves, is what ended their execution. No technical indicators -- attacker infrastructure IPs/domains, malware hashes, the content of the injected scripts, or the mechanism by which the Ribon access key itself was originally obtained -- have been publicly disclosed by BigCommerce, Be A Part Of/Fastr, or affected merchants as of this writing; every source reviewed (BleepingComputer, Born's IT- und Windows-Blog, Emery | Reddy) independently confirms this absence of technical detail rather than merely omitting it.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1195.002 Compromise Software Supply Chain
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1071.001 Web Protocols
- T1059.007 JavaScript
- T1505 Server Software Component
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service

## Sources

- [BigCommerce alerts merchants of data breach linked to Ribon apps](https://www.bleepingcomputer.com/news/security/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps/)
- [eCommerce-Plattform BigCommerce wohl über Drittanbieter Ribon gehackt](https://borncity.com/blog/en/2026/09/19/ecommerce-plattform-bigcommerce-wohl-ueber-drittanbieter-ribon-gehackt/)
- [BigCommerce Ribon App Data Breach Lawsuit](https://www.emeryreddy.com/blog/data-breach/bigcommerce-app-breach)
- [Master of Malt data breach: customer names, addresses and phone numbers exposed](https://jointheclaim.com/master-of-malt-data-breach-customer-names-addresses-and-phone-numbers-exposed/)
- [Master of Malt investigates data hack (2019, prior unrelated incident cited for organizational security history)](https://www.thespiritsbusiness.com/2019/03/master-of-malt-investigates-potential-data-hack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2610