The week in breach news Sep 23, 2026

Ecommerce platform BigCommerce confirmed a supply-chain breach involving compromised credentials from third-party app Ribon, affecting multiple merchant customers.

BigCommerce is a cloud-based SaaS ecommerce platform that businesses use to build and operate online stores without needing to develop their own commerce infrastructure. The company confirmed the credential compromise on September 17, stating that credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by Be A Part Of, a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts.

The UK-based online spirits vendor Master of Malt is among the BigCommerce customers that received breach notifications, with the retailer confirming that attackers accessed shopper information, including full names, email addresses, phone numbers and shipping postal addresses.

Customer engagement platform Brevo fell victim to a supply chain attack that resulted in malicious code being injected into more than 100,000 websites.

On September 10, a threat actor exploited a vulnerability in Brevo's handling of SAML SSO to access 138 accounts, including one belonging to cryptocurrency storage provider Trezor. The attackers sent phishing emails from six of the compromised accounts and exported contacts from 43 others. After Brevo closed the unauthorized access, the attackers returned on September 14, using a compromised long-lived Cloudflare API key to deploy a worker that injected malicious scripts into brevo.com, sibforms.com and three JavaScript files embedded by Brevo's customers across their websites.

According to reports, the malicious code was served for roughly four hours, with more than 100,000 websites likely impacted during that window.

U.S. law firm Greenberg Traurig has been sued in federal court in Manhattan following its disclosure of a data breach that exposed sensitive personal information belonging to a number of its clients.

Earlier in August, Greenberg Traurig confirmed that an unauthorized actor had accessed a limited number of documents and posted them on the dark web, with affected clients notified shortly after. The firm stated that its systems were not compromised or breached and that it has continued to operate without disruption. The information involved in the breach included names, contact information, dates of birth and Social Security numbers.

The incident adds to a growing list of U.S. law firms targeted by cybercriminals in recent months. Prominent firms, including Quinn Emanuel, McDermott, Herbert Smith Freehills Kramer, Goodwin Procter, and WilmerHale, have all reported breaches recently.

Japan's digital agency disclosed a data breach affecting the personal information of approximately 240,000 individuals.

In late June, hackers accessed files from Japan's Government Solution Service (GSS) using a maintenance and operations employee's account. A subsequent investigation determined in July that a vulnerability in a VPN product had been exploited to gain access. The attackers compromised over 246,000 records containing names, addresses, email addresses and phone numbers belonging to users, public officials, administrative staff and businesses and individuals working with GSS.

The agency did not name the exploited VPN product but confirmed that the targeted vulnerability had already been publicly disclosed before the attack was detected. The agency said it would strengthen its vulnerability management practices in response.

Germany's Ludwig Maximilian University of Munich (LMU Munich) is investigating a cyberattack in which an unknown hacker accessed a system containing sensitive student information.

LMU Munich, one of Germany's largest universities with more than 52,000 students, announced on September 19 that an attacker had accessed enrollment data stored on one of its IT systems. The university said there is no evidence that the affected data was altered or deleted and no indication so far that the stolen information has been published or misused.

The potentially affected records include students' names, dates of birth, contact details, email addresses, bank account information and details about their courses of study and previous educational qualifications.