Attackers used a stolen Ribon app key to read shopper records across BigCommerce stores

Master of Malt, the UK spirits vendor that received one of the notices, told its own customers what happened. "It looks like hackers were able to compromise a BigCommerce Application key held by Ribon, which they were able to use to gain access to customer data held on their system," the retailer said ^[7]. The credential sat with the app developer, outside the systems the affected merchants run.

BigCommerce's account covers the injection. Credentials for Ribon and Ribon 1.5 "had been compromised and used to inject malicious scripts into a small number of merchant storefronts," the company told BleepingComputer ^[8]. Master of Malt's account covers the records: full names, email addresses, phone numbers and shipping postal addresses ^[6]. BigCommerce says account passwords and payment card information are held separately and were not exposed ^[13].

Access ran from September 13 to September 17, the day BigCommerce confirmed the compromise and removed the apps, so the attacker had four days inside merchant environments ^[4][2][18]. To revoke that access, BigCommerce uninstalled the app. "Acting in the best interest of our customers and their shoppers, we uninstalled the application from affected stores to revoke the attacker's access, notified those merchants directly, and are providing log data to support the developer's investigation," BigCommerce said ^[9].

The two public accounts of scope do not agree. BigCommerce's phrase is "a small number of merchant storefronts" ^[8]. Master of Malt reported the incident to the UK Information Commissioner's Office and said it may extend well beyond its own customers, potentially to hundreds of other stores ^[3]. Law firm Emery Reddy is seeking claimants and says several unnamed retailers are currently notifying customers about exposure linked to the Ribon app key theft ^[5]. Be A Part Of and Fastr had not responded to BleepingComputer's questions by publication ^[15].

Attackers have now stolen an app vendor's BigCommerce key twice. In 2024, attackers compromised the FreshClick app on BigCommerce and injected payment-skimming code into ZAGG's store ^[16]. BigCommerce said then, as it says now, that its platform was not breached, and it removed the app ^[17][10]. What the attackers went after was different this time: this key was used to read existing customer records through BigCommerce, where the ZAGG skimmer captured card data as shoppers typed it ^[12].

Ribon's key is one of many. BigCommerce lists more than 1,200 third-party applications and integrations, Ribon among them, operated by Be A Part Of, a brand of Fastr, which works on shopping experience optimisation ^[11]. Every one of those that holds a key holds a route into the stores that installed it, and in this incident the forensic work belongs to the developer, with the platform supplying logs ^[9].