BigCommerce removes Ribon apps after reported merchant data exposure

Storefront intrusion through third-party credentials

BleepingComputer reports that attackers compromised credentials for the third-party Ribon and Ribon 1.5 applications and used them to inject malicious scripts into a small number of BigCommerce merchant storefronts. BigCommerce said the credentials were used between September 13 and September 17 to access shopper data in BigCommerce environments.

Master of Malt, one notified merchant, said affected details included names, email addresses, phone numbers, and shipping postal addresses. BigCommerce said passwords and payment-card information were stored separately and were not exposed, and that its platform itself was not breached.

Before the reported compromise was confirmed on September 17, the Ribon and Ribon 1.5 applications remained installed at affected merchant stores.

BigCommerce says it removed the affected third-party applications, notified merchants, and provided logs after the credentials were reportedly used to access shopper records and inject scripts.

Payment cards and passwords reportedly not exposed

The reported incident concerns credentials held by a third-party application rather than a breach of the ecommerce platform itself. It also reportedly involved access to existing customer records, rather than the payment-information capture described in a similar 2024 incident.