Lead Software Engineer - Infrastructure

BigCommerce merchants suffer data breach via Ribon app Key theft. September 21, 2026 - By CyberNewsAI Admin - VERIFIED INTEL SOC briefing summary:: executive Key takeaways. * [01]Threat summary: BigCommerce warned merchants that attackers compromised third-party Ribon app keys to access customer records across multiple online stores. * [02]Root cause vector: Stolen OAuth/API application keys held by developer Fastr (Be A Part Of) permitted unauthorized BigCommerce API queries and storefront script injection. * [03]Immediate action: Audit installed third-party apps, revoke and regenerate all e-commerce API keys, and enforce Content Security Policies (CSP) against unauthorized scripts. Executive summary. Leading Software-as-a-Service (SaaS) e-commerce provider BigCommerce has issued urgent notifications to online retailers following a third-party supply chain breach that exposed customer records and triggered malicious script injections across active storefronts. According to security advisories and merchant disclosures, attackers compromised API access credentials for Ribon and Ribon 1.5 - popular store-optimization applications operated by Be A Part Of, a subsidiary of digital commerce provider Fastr. The unauthorized activity commenced on September 13, 2026, when adversaries leveraged the compromised BigCommerce Application Keys to initiate unauthorized REST API requests into merchant environments. The intrusion persisted undetected until September 17, 2026, when BigCommerce security teams identified anomalous behavior, forcefully revoked the compromised credentials, and remotely uninstalled the Ribon applications across all affected merchant stores. High-profile merchants, including UK-based online spirits retailer Master of Malt, have reported the security incident to the UK Information Commissioner's Office (ICO). Compromised customer records include full names, email addresses, phone numbers, and physical shipping addresses. BigCommerce stressed that its core platform infrastructure and primary databases remained unbreached, and that account passwords and payment card information (PCI) are stored in isolated cryptographic environments that were not accessed during the incident. Technical vulnerability Analysis & attack chain. The breach underscores the severe systemic risks inherent in modern e-commerce SaaS application ecosystems, where third-party marketplace integrations frequently hold expansive API access to merchant environments: [Adversary Infiltrates Developer Environment (Be A Part Of / Fastr)] [Theft of Long-Lived BigCommerce Application OAuth / API Keys] - Keys for 'Ribon' and 'Ribon 1.5' Shopping Optimization Apps Compromised - Keys Contained Delegated Merchant Store Scopes [Automated API Reconnaissance & Data Harvesting (Sep 13 - Sep 17)] - Adversary Initiates Direct REST API Calls to BigCommerce Merchant Tenants - Queries Orders, Customers, and Shipping Endpoints: GET /api/v2/customers GET /api/v2/orders - Exfiltrates Names, Email Addresses, Phone Numbers & Physical Delivery Addresses [Storefront Script Injection & DOM Tampering Attempt] - Leverages App Script Manager Permissions (POST /v3/content/scripts) - Potential Magecart / Skimming Vector Prior to Revocation [Incident Discovery & Containment (September 17, 2026)] - BigCommerce Security Detects Anomalous API Consumption Patterns - Global Force-Uninstall of Ribon / Ribon 1.5 Across Merchant Ecosystem - Revocation of Compromised Developer OAuth Tokens 1. The anatomy of third-party SaaS application Key theft. BigCommerce supports more than 1,200 third-party applications in its ecosystem. Under the standard OAuth 2.0 authorization framework used by BigCommerce, merchants grant third-party applications granular or broad permissions (e.g., Manage Customers, Manage Orders, Manage Store Content) when installing an app from the marketplace. The threat actors gained access to the proprietary developer keys for Ribon and Ribon 1.5 directly from the developer's infrastructure (Be A Part Of / Fastr). Armed with these authentic application credentials, the attackers did not need to exploit any software zero-days or breach BigCommerce's central cloud infrastructure: * API Impersonation: The stolen keys allowed the attackers to forge authenticated requests as the legitimate Ribon service. * Multi-Tenant Infiltration: Because the compromised application was installed across hundreds of commercial storefronts, the adversary gained delegated access to all merchant tenants where Ribon held active permissions. 2. Shopper record exfiltration via REST API. Between September 13 and September 17, 2026, the attackers systematically queried BigCommerce store management APIs. Utilizing endpoints such as /v2/customers and /v2/orders, they extracted database records encompassing: * Full customer legal names * Primary contact email addresses * Verified phone numbers * Physical delivery and shipping addresses BigCommerce isolates authentication databases (salted and hashed passwords) and payment processing components (PCI-DSS tokenized card processing pipelines). Because payment cards are handled via hosted payment gateways or direct processor integrations, the API calls pulled only customer shipping and contact metadata. 3. Client-Side Script Injection threats. In addition to API exfiltration, BigCommerce confirmed that the stolen credentials were used to inject malicious scripts into a subset of merchant storefronts. E-commerce applications often retain permissions to utilize BigCommerce's Script Manager API (/v3/content/scripts) to insert tracking pixels, chat widgets, and UX optimizers into store HTML. By abusing these legitimate permissions, adversaries attempted client-side DOM tampering - a classic technique utilized by e-skimming and Magecart syndicates to capture credentials or manipulate client browsers. Prompt intervention by BigCommerce on September 17 purged the application and detached the injected scripts before widespread payment harvesting occurred. Threat Actor profile & Campaign attribution. * Campaign Parallels (The 2024 ZAGG FreshClick Incident): This attack closely mirrors the 2024 breach of mobile accessory giant ZAGG, where threat actors compromised the third-party FreshClick BigCommerce app to inject payment-skimming code directly into checkout pages. In both instances, attackers targeted trusted marketplace developers rather than attempting direct attacks against hardened e-commerce cloud providers. * Threat Actor Tradecraft: The adversary demonstrated operational familiarity with e-commerce SaaS architecture, targeting high-privilege marketplace developers to achieve massive downstream blast radius. The exfiltrated personal identity data is prime fuel for targeted phishing, credential stuffing, and executive spear-phishing campaigns. * Affected Demographics: While UK spirits vendor Master of Malt was among the first to alert consumers, legal notices indicate that dozens to hundreds of global merchants utilizing Ribon tools may be impacted across North America and Europe. Detection & SOC mitigation playbook. 1. Patch & workaround guidance. * Audit and Purge Compromised Applications: * Log into the BigCommerce Control Panel and navigate to Apps -> Manage My Apps. * Verify that Ribon and Ribon 1.5 are uninstalled. * Review all remaining third-party apps for unnecessary permissions, particularly those with access to customer lists or storefront script injection capabilities. * Credential & API Key Rotation: * Immediately rotate all BigCommerce Store-Level API accounts, webhooks, and private API tokens generated for external services. * Revoke and re-issue any API secrets shared across multiple integration platforms. 2. Network & perimeter defenses. * Implement Strict Content Security Policy (CSP): * Enforce restrictive Content-Security-Policy headers on all e-commerce storefronts to prevent unauthorized external scripts from executing or exfiltrating data: Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.bigcommerce.com https://*.trustedpayments.com; connect-src 'self' https://api.bigcommerce.com; object-src 'none'; * Enable Subresource Integrity (SRI): * For all scripts loaded from external CDNs, mandate Subresource Integrity hashes to block tampered script execution in customer browsers. 3. Endpoint detection & hunting query. BigCommerce API Audit query: Detecting high-volume customer endpoint pulls. - BigCommerce Access Log Analysis: Detecting automated customer data scraping timestamp, client_ip, request_method, request_uri, http_status, user_agent, oauth_client_id, response_size_bytes FROM bigcommerce_api_access_logs WHERE request_uri LIKE '%/v2/customers%' OR request_uri LIKE '%/v2/orders%' AND timestamp BETWEEN '2026-09-13T00:00:00Z' AND '2026-09-17T23:59:59Z' AND (response_size_bytes > 50000 OR http_status = 200) ORDER BY response_size_bytes DESC; Splunk hunting query: outbound storefront script callouts to unrecognized endpoints. index=web_proxy sourcetype=squid_access | search uri_path="*/checkout*" OR uri_path="*/cart*" | eval domain=replace(dest_host, "^[^.]*.", "") | where NOT (domain IN ("bigcommerce.com", "paypal.com", "stripe.com", "google-analytics.com", "fastly.net")) | stats count earliest(_time) as first_seen latest(_time) as last_seen values(uri) by src_ip, dest_host | sort - count Indicators of Compromise (IOCs) 6 Identified // verified_sources_&_references. OPERATIONS_BROADCAST Watch full video briefings on youtube.

BigCommerce alerts merchants of data breach linked to Ribon apps. * September 21, 2026 * 05:18 PM * 0 Ecommerce platform BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores. The cloud-based Software-as-a-Service (SaaS) ecommerce platform confirmed the credential compromise on September 17 and immediately removed the apps to protect its customers. UK-based online spirits vendor Master of Malt is one of the BigCommerce customers that received the notification. The retailer said the attacker accessed shopper information. The hacker used the compromised credentials to access shopper data in BigCommerce environments between September 13 and September 17, the company said. In updates on the incident, Master of Malt says impacted shopper details include full names, email addresses, phone numbers, and shipping postal addresses. "It looks like hackers were able to compromise a BigCommerce Application key held by Ribon, which they were able to use to gain access to customer data held on their system," Master of Malt stated. BigCommerce supports over 1,200 third-party applications and integrations, including Ribon, an application operated by Be A Part Of, a brand operated by Fastr, specialized in shopping experience optimization. The e-commerce platform says it stores account passwords and payment card information separately and that this type of data was not exposed. In a statement for BleepingComputer, BigCommerce said that the attacker compromised credentials for Ribon and Ribon 1.5 applications. "On September 17, 2026, Commerce confirmed that credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by 'Be A Part Of,' a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts." The company underlined that its systems or the BigCommerce platform were not breached. "Acting in the best interest of our customers and their shoppers, we uninstalled the application from affected stores to revoke the attacker's access, notified those merchants directly, and are providing log data to support the developer's investigation," the company told BleepingComputer. Master of Malt reported the incident to the UK Information Commissioner's Office (ICO) and noted that it may extend well beyond its own customers, potentially to hundreds of other stores. Law firm Emery Reddy is seeking potential claimants linked to the incident, saying several retailers are currently notifying customers about data exposure linked to the Ribon app key theft, without naming any. BleepingComputer has contacted Be A Part Of and Fastr for more information about the incident but Bleeping Computer, LLC has not received a response by publication time. The incident is similar to a 2024 breach affecting electronics accessory maker ZAGG, where attackers compromised the third-party FreshClick BigCommerce app and injected payment-skimming code into its online store. At the time, BigCommerce told BleepingComputer that its platform was not breached and removed the compromised app from customers' stores. However, unlike the ZAGG incident, where attackers captured payment information entered by customers during checkout, the Ribon attackers used a compromised application key to access existing customer records through BigCommerce. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

BigCommerce moves agentic commerce into authenticated B2B buying. BigCommerce's latest MCP update gives AI agents controlled access to shopping lists, approvals and quotes. The real test is whether those agents can act within the buyer's organizational permissions. Justin King Chief AI Officer · B2B eCommerce Association Most commerce agents can help a buyer find a product. The harder test begins after the buyer signs in. That is where account permissions, approval rules, shared shopping lists, quotes and active carts enter the workflow. BigCommerce took a meaningful step into this territory on September 16 by adding authenticated shopping sessions and new B2B tools to its Model Context Protocol server. From product discovery to buying action. The release introduces Storefront Session Sync, which connects an agent's MCP session to a shopper's existing Stencil storefront session through a short-lived, opaque token. BigCommerce says the buyer's login state, identity and cart can pass into the agent without exposing browser cookies. The storefront can also remain synchronized if the agent creates a new cart. For B2B buyers, the platform now offers 12 shopping-list tools. These cover actions such as creating and updating lists, adding or removing products, submitting a list for approval, and approving or rejecting it. Five quote tools let authorized buyers request a quote, review details, message a sales representative and generate a checkout link. The real test is authority. The B2B tools require BigCommerce B2B Edition and are made available according to the buyer's permissions. That distinction matters. A user may be able to prepare a shopping list but not approve it. Another buyer may be authorized to request a quote without being able to accept its commercial terms. This is the point where agentic B2B commerce becomes more consequential. Authentication confirms who is present. It does not, on its own, establish everything that person is allowed to do across different companies, branches, budgets or purchasing roles. For manufacturers and distributors, the value will depend on whether the agent preserves this context throughout the transaction. Commerce teams should test: * whether the agent receives exactly the permissions assigned to the buyer; * whether approval workflows remain intact; * whether products, quantities and messages stay aligned throughout a quote; * what happens when a session expires, an account changes or a cart already exists; and * whether the business can reconstruct who initiated, performed and approved each action. Account-specific product access, negotiated pricing and inventory rules also need direct validation. BigCommerce's announcement documents identity, carts, permissions, shopping lists and quotes, but does not provide production evidence showing how every connected commercial rule will perform in practice. The release is still an important market signal. BigCommerce is moving agents beyond product recommendations and cart creation into recognizable B2B buying workflows. The next proof point will be whether customers can reduce the effort involved in repeat purchasing and quote preparation without increasing pricing errors, unauthorized actions or manual cleanup. The question for B2B commerce teams is no longer simply, "Can the agent find the right product?" It is, "Can the agent act for this buyer, inside this company's rules, and prove that it did?" Editorial note: Product capabilities are based on BigCommerce's technical announcement. Operational implications and evaluation recommendations are B2BEA analysis. No customer performance data was included in the source.