BigCommerce merchants hit by credential breach via Ribon third-party apps

Tue, 22 Sep 2026 15:30:54 +0000

Engineer — Plan: If you run BigCommerce storefronts with third-party apps, audit installed apps for Ribon-linked integrations and review your CSP headers and script-injection monitoring; no CVE or patch available, but credential hygiene for marketplace apps is the control surface here.
SOC/IR — Plan: Add detection coverage for unexpected third-party script injections in e-commerce environments; hunt for new or modified script tags in storefront page responses if BigCommerce is in scope for your estate.
Leader — Act: If your organization operates BigCommerce storefronts, confirm whether Ribon apps are installed and request BigCommerce’s incident report; this may trigger PCI DSS or customer notification obligations if payment-adjacent data was exposed.

Ecommerce on CuraSec