HeartMath emailed store customers that on September 19, 2026 it learned an unauthorized party had accessed an application used on its online store between September 12 and September 18. The company named BigCommerce as the third-party website-development partner. The notice says the data may have included name, email, phone, billing and shipping address, and order history — and that passwords, card numbers, and CVVs were not accessed.
HeartMath’s shopper letter does not name the app. In the same window, BigCommerce told BleepingComputer (Sept 21) and SecurityWeek (Sept 22) that API credentials for third-party apps Ribon and Ribon 1.5 (Be A Part Of / Fastr) were used from about September 13–17, then revoked. BigCommerce says that was not a breach of its own platform. Treat Ribon as the industry explanation unless HeartMath names the app.
Type store.heartmath.com or heartmath.com yourself. Call (800) 450-9111 or write support@heartmath.com from a number or address you already have — not from a follow-up text.
Snapshot
| Field | Detail |
|---|---|
| Shopper notice | HeartMath email — learned September 19, 2026 |
| Access window (HeartMath) | September 12–18, 2026 |
| What HeartMath named | BigCommerce store application |
| Industry context | Ribon / Ribon 1.5 API key — BigCommerce press statements |
| Cards / passwords | Not accessed, HeartMath and BigCommerce say |
| CourtListener | 0 RECAP dockets naming HeartMath or this campaign (Oct 12, 2026) |
| CA AG sample list | No HeartMath row found (Oct 12, 2026) |
| Official hosts | Type store.heartmath.com · heartmath.com |
Who is at risk
HeartMath store shoppers whose contact and order records sat in the store application during that week. OneMagnify’s HeartMath case study describes the brand on BigCommerce. Master of Malt, another BigCommerce merchant, told customers the same field list and said the Ribon key may have touched hundreds of stores. HeartMath did not publish a headcount.
A name, email, phone, and address is enough for a “we need to confirm your order” phishing wave. MFA on HeartCloud does not un-copy that address book.
What to watch for
- Mail or texts that reuse support@heartmath.com, (800) 450-9111, or the Boulder Creek street address
- A link that asks you to log in, re-enter a card, or share a code
- “HeartMath security” mail that does not come from an address you already use
- Offers of free credit monitoring that you did not ask HeartMath for — the shopper letter we reviewed did not enroll people in monitoring
Meta-class Marketplace lures show how a live name-and-number pair gets a reply. Treat this list the same way.
What to do
- If you shopped HeartMath and the letter matches, treat email, phone, and address as exposed. Watch for shipping-change and gift-card scams.
- Type store.heartmath.com yourself. The store login now sends you through HeartMath SSO — do not use a link from a new message.
- HeartMath says cards were not taken. Still review bank and card statements. Report theft at IC3.
- Questions: support@heartmath.com or (800) 450-9111, from HeartMath’s help page — not from the lure.
- Put a YubiKey on email and banking. That does not recall the store export.
MFA: YubiKey and Google Authenticator
HeartMath’s store sign-in tells shoppers to use HeartMath single sign-on. HeartCloud help documents email and password (and an emailed password-reset key). It does not document a self-serve YubiKey or Google Authenticator path. BigCommerce’s control-panel 2FA is an authenticator app (Authy, Google Authenticator, or other TOTP) for staff, not shoppers. No public YubiKey path. MFA would not have blocked a stolen app key from reading store records.
Grades match our MFA directory.
| Grade | Meaning |
|---|---|
| Fail | No self-serve YubiKey / open TOTP — or SMS / email OTP remains |
| Pass | Self-serve Google Authenticator-style open TOTP |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| HeartMath / HeartCloud | Fail | No | No |
| BigCommerce admin | Pass | No | Yes |
Directory: MFA support directory · Category → Business Apps.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited reporting, platform, brand, and store hosts on October 12, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not score the store-app key.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| FBI IC3 | ic3.gov | 87% | −13 |
| BigCommerce | bigcommerce.com | 67% | −33 |
| HeartMath | heartmath.com | 65% | −35 |
| HeartMath store | store.heartmath.com | 35% | −65 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| ic3.gov | 90% | 45% | 97% |
| bigcommerce.com | 50% | 15% | 87% |
| heartmath.com | 65% | 15% | 62% |
| store.heartmath.com | 0% | 45% | 43% |
Audit links: ic3.gov · bigcommerce.com · heartmath.com · store.heartmath.com
store.heartmath.com Identity 0% is the weak host: spoofed “store update / order confirm” mail is easy to deliver. heartmath.com and bigcommerce.com Transport 15% is the same problem on the brand and platform names.
Website stack note
Passive website-tech probes on October 12, 2026:
| Domain | Stack signal |
|---|---|
| heartmath.com | Undetected CMS; Google Trust Services TLS expires 2027-01-08 |
| store.heartmath.com | Laravel; DigiCert TLS expires 2027-03-20 |
| bigcommerce.com | Next.js (X-Powered-By exposed); DigiCert TLS expires 2027-02-26 |
| ic3.gov | Undetected CMS; DigiCert TLS expires 2027-01-05 |
Point-in-time only. A marketing homepage is not a store-app forensic finding.
Blacklist and lookalike domains
Email blacklist checks (public DoH, October 12, 2026): bigcommerce.com and ic3.gov were clear. heartmath.com showed SPFBL hits on shared Mimecast MX — do not read that as “HeartMath is blacklisted.”
DNS lookalike scans (BEC profile, registered signals only):
| Brand scanned | To review | Likely owned | BEC staging |
|---|---|---|---|
| heartmath.com | 6 | 5 | 0 |
| bigcommerce.com | 12 | 2 | 0 |
High-interest registered names (investigate; not proof this incident used them):
| Lookalike | Technique | Note |
|---|---|---|
| heartmath.org | tld-swap | HeartMath Institute (nonprofit) — not the store |
| iheartmath.com | insertion | Live NS + A |
| baigcommerce.com | insertion | Live NS + A + MX |
| bigscommerce.com | insertion | Live NS + A |
heartmath.app, .biz, .co, .info, and .us redirect to the real store (likely owned). Type store.heartmath.com and heartmath.com. Continuous monitoring: Cybersquat Domain Monitoring.
Related coverage
- Facebook Marketplace name-and-number lure
- WooCommerce Wholesale Lead Capture CVE-2026-27540
- Heights Finance third-party cloud notice
- MFA support directory
Run a free audit at audit.emailmenow.com or contact EmailMeNow for DMARC / MTA-STS and phishing response aimed at the 100% ideal.
Sources: HeartMath shopper notice (Sept 19, 2026 notice date; Boulder Creek, CA) · BleepingComputer — Ribon apps (Sept 21, 2026) · SecurityWeek (Sept 22, 2026) · OneMagnify — HeartMath / BigCommerce · HeartMath support · HeartCloud register · BigCommerce 2FA · IC3. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 12, 2026. Domain scores: audit.emailmenow.com only.