BigCommerce warns customers of potential data leaks following cyber incident

Ecommerce platform BigCommerce has confirmed a supply-chain security breach involving the third-party application Ribon. Between September 13 and September 17, 2026, unauthorized actors compromised Ribon’s application credentials, allowing them to inject malicious scripts into various merchant storefronts. The breach resulted in the exposure of customer personal information, including names, email addresses, phone numbers, and physical addresses. While BigCommerce characterized the incident as affecting a small number of stores, reports from affected merchants like Master of Malt suggest the impact may be broader, potentially involving hundreds of retailers. The company has since revoked the compromised access keys and uninstalled the application from affected stores. No passwords or payment information were accessed, as these are stored in separate, secure systems. BigCommerce is currently providing log data to assist in the ongoing investigation, and affected retailers have been notified to mitigate further risks.