Threat Intelligence Brief
Curated summary with source attribution
Source: bleepingcomputer.com
Threat Risk: Medium
Victim: BigCommerce merchants
Incident: Data breach via compromised third-party application credentials.
Impact: Exposure of customer PII, including names, email addresses, and shipping details.
Attacker: Unidentified threat actors
Analysis: Attackers exploited compromised API keys from the Ribon and Ribon 1.5 third-party applications to access merchant environments. This allowed the unauthorized extraction of customer PII and the injection of malicious scripts into online stores. The incident underscores the persistent risk associated with over-privileged third-party SaaS integrations.
Recommendations: Audit all third-party application permissions and remove unused integrations; Implement the principle of least privilege for all API keys and app integrations; Continuously monitor storefronts for unauthorized script injections or source code changes
Source: BleepingComputer
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-09-22 21:14 UTC
Data breach via a compromised third-party app API key. Theft of customer PII and injection of malicious scripts into online stores. Attackers stole an API key belonging to the Ribon app, allowing them to impersonate legitimate requests and access customer PII across various BigCommerce stores. In addition to data theft, the actors injected malicious scripts into several storefronts. This incident highlights the significant risk posed by over-privileged third-party integrations in e-commerce ecosystems.
Corroborating source: safestate.com