aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, attackers compromised credentials for Ribon third-party applications on the BigCommerce platform, operated by Be A Part Of (a Fastr company). Between September 13-17, the threat actors used stolen API keys to inject malicious scripts into merchant storefronts and access customer data including names, email addresses, phone numbers, and shipping addresses. BigCommerce immediately removed the compromised applications and notified affected merchants, with companies like Master of Malt confirming exposure of shopper information. While BigCommerce's core platform remained secure, the incident demonstrates the expanding attack surface created by third-party integrations in e-commerce ecosystems. This supply chain compromise highlights the growing trend of attackers targeting less-secured vendor applications to reach high-value customer databases, particularly as organizations increasingly rely on SaaS integrations for enhanced functionality.

Why This Matters Now

Third-party app compromises are accelerating as attackers exploit the expanded attack surface of integrated SaaS platforms, making vendor security assessments and API key management critical priorities for preventing supply chain breaches.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Zero trust segmentation with least privilege access controls could have limited the Ribon app's access to only necessary customer data, preventing broad database exposure even with compromised credentials.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely have reduced the blast radius of this BigCommerce supply chain attack by constraining lateral movement between merchant environments and limiting data access scope through segmented API interactions.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Zero Trust network segmentation would likely have limited the scope of compromised application access by restricting API key reach to specific merchant environments rather than broad platform access

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Workload-level segmentation would likely have constrained privilege escalation by isolating API access permissions and limiting cross-tenant resource visibility within the BigCommerce platform

Lateral Movement

Control: East-West Traffic Security

Mitigation: Microsegmentation controls would likely have reduced lateral reach between merchant environments by enforcing strict inter-tenant traffic policies and limiting cross-store access patterns

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Network visibility controls would likely have detected anomalous script injection patterns and constrained persistent access by monitoring east-west traffic flows between compromised applications and merchant resources

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely have constrained data exfiltration volume by enforcing strict outbound traffic controls and limiting external communication paths from compromised merchant environments

Impact (Mitigations)

While regulatory notifications would still be required, the constrained blast radius from Zero Trust segmentation would likely have reduced the total number of affected merchants and customers requiring notification

Impact at a Glance

Affected Business Functions

  • E-commerce Operations
  • Customer Data Management
  • Online Payment Processing
  • Third-party App Integration
Operational Disruption

Estimated downtime: 1 days

Financial Impact

Estimated loss: N/A

Data Exposure

Customer personal information including full names, email addresses, phone numbers, and shipping postal addresses of multiple BigCommerce merchants using Ribon applications. Master of Malt and potentially hundreds of other online retailers affected. Payment card information and account passwords were not compromised as they are stored separately.

Recommended Actions

  • • Implement Zero Trust Segmentation to isolate third-party application access and limit scope of credential compromise through identity-based policies and least privilege enforcement
  • • Deploy Egress Security & Policy Enforcement to detect and block unauthorized data exfiltration attempts and malicious script communications to external destinations
  • • Enable Multicloud Visibility & Control to monitor anomalous interactions between third-party applications and detect suspicious automation patterns across merchant environments
  • • Establish Threat Detection & Anomaly Response capabilities to baseline normal third-party application behavior and alert on credential misuse or unauthorized access patterns
  • • Implement Encrypted Traffic controls to protect customer data in transit and prevent interception during exfiltration attempts through line rate encryption and secure private circuits

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image