BigCommerce alerts merchants of data breach linked to Ribon apps
BigCommerce has notified merchants that attackers compromised credentials tied to third-party Ribon applications, then used that access to inject malicious scripts into online stores. The breach originated outside BigCommerce's own systems, through a connected app provider.
Why this matters: When you shop at a small online store, you assume the checkout page is safe. You do not know which third-party apps are running underneath it. That is the real exposure here. Merchants trusted a plugin, that plugin got compromised, and now customer data may have walked out through scripts that looked like normal store code. This is supply chain risk at the retail level. The store owner is on the hook, even though the problem started somewhere they had limited visibility into.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.