BigCommerce Merchants Hit by Data Breach Tied to Compromised Ribon App Credentials

What Happened

BigCommerce has notified multiple merchants of a data breach after attackers compromised credentials for third-party Ribon applications integrated with their online stores. According to BleepingComputer, the attackers used the stolen Ribon app credentials to inject malicious scripts into affected storefronts.

Details on the scope of the breach, how the Ribon credentials were originally obtained, and the exact nature of the injected scripts have not been fully disclosed at this time.

Why It Matters for Defenders

This incident is a reminder that ecommerce platforms carry supply-chain risk through third-party app integrations. A single compromised app credential can grant an attacker the ability to modify storefront code across every merchant using that integration, potentially enabling web skimming, credential theft, or further script-based attacks against site visitors and customers.

Merchants using BigCommerce with Ribon apps installed are directly affected, but the broader lesson applies to any organization relying on third-party app marketplaces with elevated access to production storefronts.

What Defenders Should Watch For

• Review installed third-party apps and integrations on ecommerce platforms, and rotate credentials/API keys for any app connected to the incident or with broad storefront permissions.
• Audit storefront JavaScript and checkout pages for unexpected or unauthorized script injections, especially recently modified files or newly added external script sources.
• Monitor for anomalous API activity associated with third-party app credentials, such as unexpected content/script modifications outside normal deployment windows.
• Consider Content Security Policy (CSP) controls and subresource integrity checks to limit the blast radius of unauthorized script injection on customer-facing pages.
• Watch for follow-on indicators such as unfamiliar outbound requests from checkout pages, which can signal web skimming activity tied to injected scripts.

Developing Story

This is a developing story and further details from BigCommerce or Ribon about scope, root cause, and remediation may emerge. For the original reporting, see BleepingComputer's coverage.