BigCommerce API Key Theft via Ribon Exposes Merchant Data Stores September 13-17

The incident began with compromise of Fastr/Be A Part Of systems holding Ribon credentials. Attackers then called BigCommerce APIs to iterate customer records page-by-page across installed stores. Master of Malt’s post-incident analysis shows the key remained valid for four days, allowing bulk extraction until revocation on the 17th. BigCommerce uninstalled the apps and notified merchants on the 18th but confirmed no platform-level breach occurred. BigCommerce’s statement separates its SaaS boundary from third-party app credentials, yet the attack surface is identical: long-lived API keys issued to external developers. Procurement records and app marketplace listings reveal over 1,200 integrations with similar OAuth or key-based access, none subject to routine rotation audits. Parallel incidents at CrowdSec and Gyazo demonstrate the same pattern of stolen developer credentials enabling downstream data pulls. Operational risk persists because merchants cannot verify upstream key hygiene. Fastr has issued no public statement or incident report. Expect continued enumeration of similar app keys until platforms enforce short-lived tokens and per-merchant scope limits. Next indicator will be whether additional merchants surface data in dark-web dumps within 60 days.