Breached without a breach: how one third-party app key exposed the customers of hundreds of online stores
Between 13 and 17 September 2026 attackers collected shopper data from online stores on the BigCommerce platform. Not one of those stores was breached. A key belonging to a third-party app — one the stores themselves had trusted with access to their customers — was enough.
---
## What happened
On 17 September BigCommerce, one of the largest cloud e-commerce platforms, confirmed that the credentials of two third-party apps — Ribon and Ribon 1.5 — had been compromised. The apps belong to Be A Part Of, trading as Fastr, and are used to optimize the shopping experience on storefronts.
Using the stolen credentials, the attackers injected malicious scripts into some storefronts and gained access to shopper data. BigCommerce removed the app from every affected store, revoking its access, notified merchants directly and handed the logs to the app's developer for investigation.
The timeline:
- **13 September, 17:21** — unauthorized access begins;
- **17 September, 21:12** — the stolen key is revoked and the app removed from stores;
- **18 September** — BigCommerce notifies merchants. Ribon's developer only contacts those affected that evening;
- **21 September** — the incident becomes public.
For four days the attackers worked with customer data unimpeded.
## Who was affected
The first to go public was the British online spirits retailer **Master of Malt**. Customers' full names, email addresses, phone numbers and delivery addresses were exposed.
The store sent notifications to customers within hours of hearing from BigCommerce, notified the UK regulator ICO and warned that the incident could affect potentially hundreds of other stores. Master of Malt also intends to press the platform for stricter control over third-party API access: in the company's view, one compromised key should not unlock the data of many stores.
Account passwords and payment card data are stored separately and were not affected, according to BigCommerce.
## Why this matters: you can be breached without being breached
The defining feature of this incident is that **neither BigCommerce nor the stores were compromised**. The platform makes that point explicitly.
What was compromised is a third-party app's access key. The stores handed that key to the app themselves at install time, opening up their customer base to it. Having taken the key, the attackers got everything it unlocked — the shopper data of every store where Ribon was installed.
For a store owner it looks like this: you have a strong password, two-factor authentication, an up-to-date platform, and your customers' data leaked anyway. Because someone stole a key from a contractor you may have long forgotten about.
One number shows the scale of the problem: BigCommerce supports **more than 1,200 third-party apps and integrations**. Each one is a potential entry point of exactly this kind.
## This has happened before
The incident almost word for word repeats the 2024 story of the accessories maker **ZAGG**. Back then attackers compromised the FreshClick third-party app for BigCommerce and injected code that stole bank card data on the payment page. The platform said then too that it had not been breached, and removed the compromised app.
The only difference is the loot. In 2024 cards were stolen as they were typed in. In 2026 it is customer data already collected, taken through an access key.
The conclusion is simple: the threat model doesn't change, only what gets stolen next time.
## The bottom line
An online store's perimeter stopped ending at its own server long ago. It includes every app, every integration and every script you have granted access to. The whole chain needs protecting, because attackers pick the weakest link, not the most obvious one.
The incident is still under investigation and the final picture may change. But the main lesson is already clear: the trust you extend to a third-party app is part of your attack surface too.
---
*This article is based on a BleepingComputer report (21 September 2026), Master of Malt's official notice and public information about the investigation. Ribon's developer had not commented on the incident at the time of publication.*