On September 17, 2026, an attack was disclosed in which threat actors gained access to BigCommerce customer data through a third-party application called Ribon. The attackers obtained access to the application’s API key and used its permissions to access customer data, including names, email addresses, phone numbers, and shipping addresses.
The interesting part is that BigCommerce itself was not breached. The access came through a third-party system that was connected to the environment and had been granted permission to access data.
And that is something every organization needs to consider.
We invest heavily in protecting the systems under our direct control: our networks, servers, endpoints, employees, and access to sensitive information. At the same time, we continue to connect more applications, vendors, services, and integrations to our environments, often giving them significant access to our systems and data.
Once that connection exists, part of our security depends on the security of that third party. If their account is compromised, an API key is stolen, or one of their systems becomes an entry point for an attack, the consequences can reach us even if no one managed to breach our own systems directly.
The same principle applies to phishing. Attackers do not always need to reach an organization directly. Sometimes they can exploit a system or service that has already earned our trust, using that trusted connection to reach employees, customers, or data.
That means cybersecurity is no longer only about how well we protect what is inside our organization. It is also about how well we understand and monitor the places where we extend our trust, access, and connections.
Because sometimes, to get to your data, an attacker doesn’t need to break into you.
They only need to find someone who is already connected to you.
