Your Shipping Address Was Fair Game: A Hacked BigCommerce App Exposed Shopper Data

The App You Never Heard Of Just Handed Out Your Home Address

You didn't give your address to Ribon. You probably never heard of Ribon. But if you bought something from a BigCommerce-powered store between September 13 and 17, 2026, your name, email, phone number, and shipping address may have left that store without your permission.

That's the shape of this breach. The threat didn't come from BigCommerce. It came from a small app sitting inside the store, a layer most shoppers never see and most merchants rarely audit.

How Did Attackers Get In?

Ribon and Ribon 1.5, both built by a company called Be A Part Of under the Fastr umbrella, were third-party apps merchants could install on their BigCommerce storefronts. Apps like these run on API credentials: keys that let them talk to a store's data on the merchant's behalf.

Fastr's own systems were breached first. Attackers got those credentials. With the keys in hand, they had a direct bridge into every merchant store that had Ribon installed. They used that access two ways. They injected malicious scripts into some storefront pages, and they pulled existing customer records from store databases.

BigCommerce confirmed the breach, disabled the compromised API key, and removed both Ribon apps on September 17. Merchant notifications started going out September 18.

What Data Left the Building?

The exposed records included:

• Full names
• Email addresses
• Phone numbers
• Shipping postal addresses

Passwords were stored separately. Payment card data never touched Ribon's access level. Both were safe. That genuinely matters for immediate financial risk. But a list of real names, phone numbers, and home addresses is still a working toolkit for fraud, phishing, and physical targeting. Scammers don't need your credit card number to cause damage. They need to sound credible and know where you live.

Why Did This Reach So Many Stores?

Ribon was installed on hundreds of BigCommerce stores. The attack actively impacted only a subset of them, but a single compromised credential was the key to all of them at once. That's what makes a supply-chain attack so efficient for attackers.

A merchant builds a store. They install a handful of apps to add features and trust that those apps are secure. Each app brings its own code, its own servers, its own security posture. When that third-party layer breaks, the breach travels directly into the merchant's customer data. The merchant did nothing wrong. Their platform did nothing wrong. The weak point was invisible to both of them.

Founders and store operators often spend serious effort securing their own code and then install a dozen integrations without the same scrutiny. Each one is an attack surface they didn't fully author.

What Should You Do Right Now?

If you shop online:

1. Check your email for a notification from any BigCommerce-powered store you ordered from, especially purchases made between September 13 and 17, 2026.
2. Watch for phishing messages. Attackers who have your name, email, and address will use all three to make a scam look legitimate. Be skeptical of any message asking you to click a link or confirm account details.
3. If you reused a password on any store account, change it now. Passwords weren't exposed in this specific breach, but reused passwords are a separate risk that bites hard when other breaches surface.
4. Turn on two-factor authentication on any account where you've stored payment methods or personal information. An authenticator app is stronger than SMS.
5. Consider a free credit freeze at Equifax, Experian, and TransUnion. A freeze won't stop address-based scams, but it blocks new credit accounts from being opened in your name without your knowledge.
6. Data-removal services can scrub your contact info from data broker websites. Breaches like this one often feed those databases, and your address staying off reseller lists reduces your exposure in future incidents.

If you run a store on any platform:

1. Open your app or integration dashboard today and look at every third-party tool currently installed. Ask whether you still use it, whether you still need it, and when you last checked whether the vendor has had a security incident.
2. Remove anything you're not actively using. Unused integrations are the highest-risk category. They still hold permissions but get zero ongoing attention.
3. Check what permissions each active app actually has. Many request far more access than they need to function.
4. Set a recurring quarterly calendar reminder to run this audit. It takes twenty minutes and it's the kind of thing that feels unnecessary until it isn't.

The Truth Behind the Headline

What makes this breach worth your attention isn't just the data that was taken. It's the path attackers chose.

They didn't attack BigCommerce. They attacked a small vendor that most merchants wouldn't think twice about. They got one key, and that key opened many doors simultaneously.

The trust you extend when you install an app is a real, transferable thing. It carries real permissions into your customer data. And when that vendor gets hit, your customers feel it before you do. That asymmetry isn't going away.

Do this now:

• If you shopped at a BigCommerce store in mid-September 2026, watch your inbox for a breach notification and stay alert to phishing attempts using your real name and address
• Change reused passwords and enable 2FA on any account with payment or personal data stored
• Request a free credit freeze from all three major bureaus if you want an extra layer of protection
• If you run a store, audit your third-party integrations this week and remove anything you're not actively using

Sources

• bleepingcomputer.com
• securityweek.com