BigCommerce
Every sale hands your details to an independent seller the platform says it does not answer for, and your browsing and purchase history is what the ads run on. Policies that say they do not sell your data concede in the same paragraph that the same flow may count as a sale under some laws.
Reported incidents
Shoppers' details taken from online shops through a hijacked add-on app
2026-09-21Affected Ribon and Ribon 1.5 apps on BigCommerce stores
BigCommerce, which runs online shops for other retailers, said attackers used stolen credentials belonging to a third-party app, Ribon, to reach shopper records through its API between 13 and 17 September 2026. Names, email addresses, phone numbers and delivery addresses were taken. BigCommerce said passwords and card details were not affected. It removed the app from the affected shops and told those merchants directly. Master of Malt is the only retailer named so far; a law firm told BleepingComputer that several retailers are notifying customers. Ribon is made by Be A Part Of, a Fastr company.
People affected typically ask BigCommerce to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.