BigCommerce Data Breach Affected Third-Party Apps
Attackers accessed customer data by compromising application keys used on the BigCommerce platform.
Updated on Sept. 21, 2026 in Cybersecurity
Live Poll
Do you trust online retailers to protect your personal information from third-party app security breaches?
BigCommerce has confirmed that attackers exploited third-party Ribon applications to access shopper information between September 13 and September 17, 2026. The incident allowed unauthorized access to personal details, though payment data and account passwords remained secure.
Why it matters
The breach highlights the security risks inherent in relying on third-party application integrations within major e-commerce ecosystems. By compromising specific keys, attackers bypassed standard platform protections to harvest sensitive customer information from potentially hundreds of storefronts.
BigCommerce supports a total ecosystem of 1,200 third-party applications. The security failure stemmed from compromised keys within the Ribon and Ribon 1.5 applications, which are operated by the Fastr brand Be A Part Of.
The players
BigCommerce
This is a cloud-based e-commerce platform that provides software-as-a-service solutions for online businesses.
Master of Malt
This is a United Kingdom-based online retailer that received notification of the data breach and reported the incident to regulators.
UK Information Commissioner's Office
This is the independent regulatory body in the United Kingdom responsible for upholding information rights and data privacy.
The details
Attackers gained unauthorized access by compromising third-party application keys, which they used to inject malicious scripts into merchant storefronts. This allowed them to scrape full names, email addresses, phone numbers, and shipping addresses directly from BigCommerce environments.
Timeline
September 13-17, 2026: Attackers accessed shopper data.
September 17, 2026: BigCommerce confirmed the compromise and removed the affected applications.
The Tech Race
The incident involving the BigCommerce application marketplace ecosystem demonstrates that platform security is only as strong as its weakest third-party integration. This shift reflects a growing trend of supply-chain attacks designed to exploit the interconnected nature of modern e-commerce software stacks.
Shoppers at affected stores may face an increased risk of phishing attempts or spam due to the exposure of their contact and shipping information. Customers should remain vigilant for suspicious communications and monitor their accounts for unauthorized activity.
The takeaway
Users should be aware that their data remains vulnerable when retailers integrate third-party tools that may have weaker security protocols than the main platform. Reviewing privacy notifications from your favorite online retailers can help you track if your personal information was included in a specific incident.
Further reading
For more information on protecting e-commerce platforms, visit our section on Cybersecurity.
Live Poll
Do you trust online retailers to protect your personal information from third-party app security breaches?
