Loading story…
Attackers compromised API credentials for the third-party Ribon and Ribon 1.5 applications, operated by Be A Part Of, a Fastr company, and used them to access customer records in BigCommerce merchant environments. Between September 13 and 17, they also injected malicious scripts into a small number of storefronts; reported exposed data included customer names, email addresses, phone numbers, and shipping or physical addresses.
BigCommerce said its core platform and systems were not breached and that passwords and payment-card data were not exposed. The company disabled the compromised credentials, removed the affected apps from impacted stores, revoked attacker access, notified merchants, and provided logs to support the application developer's investigation.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
BigCommerce began directly notifying affected merchants and supplied log data to support the Ribon developer's investigation. It stated that its own platform and systems were not breached and that passwords and payment-card information were not exposed.
BigCommerce confirmed the Ribon credential compromise and revoked the compromised application key, ending the documented period of unauthorized access. The company also removed the affected applications from impacted stores to revoke attacker access.
Ribon developers became aware that the application's compromised credentials were being misused.
Attackers used compromised Ribon and Ribon 1.5 credentials to access customer records held in BigCommerce environments and inject malicious scripts into a small number of merchant storefronts. The accessed data included customer names, email addresses, telephone numbers, and physical or shipping addresses.
Master of Malt, a BigCommerce customer, reported the incident to the UK Information Commissioner's Office and warned that customers of hundreds of other stores could potentially be affected.
Fastr, the operator of Be A Part Of and the Ribon applications, experienced a system compromise that exposed API credentials for Ribon and Ribon 1.5. The initial compromise method was not disclosed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor using the alias **"misere"** is offering what they claim is **Bureau Vallée** customer data allegedly obtained from a third-party supplier rather than the retailer itself. The seller claims the supplier exported customer data for each store daily to an unprotected external server or FTP service hosted outside France, yielding **13,725,669** total records and **4,819,927** unique records. A **10,000-record** sample was reportedly published, but no field list was disclosed and the claims remain unverified. The actor further alleges they exploited **injection flaws** on internet-facing systems to achieve command execution and maintain persistent access for about a month, with access still active at the time of posting. If confirmed, the incident would reflect a **trusted-relationship/supply-chain compromise** in which a downstream organization is exposed through a service provider’s insecure workflow, a pattern seen in broader intrusions involving managed service providers, cloud partners, and software suppliers such as **SolarWinds**, where compromise of an intermediary enabled access to multiple customer environments.
Aug 23, 2026
Multiple Japanese B2C e-commerce sites were compromised in a web skimming campaign that stole customers’ personal information, login credentials, and payment card data by injecting malicious JavaScript into checkout, login, and registration pages. Reporting from LAC linked the activity to techniques similar to **Water Pamola**, which Trend Micro and JPCERT/CC previously described as abusing malicious order submissions containing XSS payloads; when viewed in merchant administration panels, the payloads executed in administrators’ browsers, enabling credential theft, web shell deployment, and further compromise of the online store. The campaign affected sites built on **EC-CUBE** as well as other platforms, indicating the attackers were targeting exploitable e-commerce implementations rather than a single product. The skimming code evolved over time, including increased obfuscation and infrastructure changes from `googlevapis[.]com` to `jqueryapistatic[.]com`, while some incidents used the victim’s own domain as an HTTPS exfiltration endpoint to reduce detection. Investigators said the attackers harvested cardholder names, card numbers, expiration dates, security codes, email addresses, and passwords, and recommended patching platforms and plugins, restricting administrator access, enabling MFA, deploying WAF protections, and reviewing logs for connections to known malicious domains.
Aug 15, 2026
E-commerce marketplace **Storenvy** was reportedly breached, exposing about **1.5 million user accounts** in a leak that included credentials stored in **plain text**. Reports said the compromised data contained usernames, email addresses, IP addresses, and passwords, sharply increasing the risk of account takeover, credential stuffing, and follow-on compromise for users who reused the same passwords on other services. The incident stood out because the leaked passwords were allegedly not hashed, reflecting weak credential protection practices at the time of the breach. Users affected by the exposure were urged to reset their Storenvy passwords immediately, change any reused passwords on other platforms, and enable stronger account protections where available, while defenders were advised to watch for phishing and suspicious login activity tied to the leaked records.
Jul 12, 2026