Online whisky retailer Master of Malt has confirmed that customer data was stolen in a breach involving a third-party application connected to its BigCommerce store. The company began notifying customers this week after discovering that Ribon, an app used for marketing or loyalty functions, had been compromised. According to a customer notification, attackers gained access to an application key held by Ribon and used it to pull names, addresses, email addresses, and phone numbers over a four-day window in mid-September.
BigCommerce, which operates the e-commerce platform hosting Master of Malt, clarified that the incident stemmed from a compromise at Fastr, the parent company of Ribon's developer. API credentials for both Ribon and Ribon 1.5 were used to inject malicious scripts into a small number of merchant storefronts. BigCommerce stressed that its own systems were not breached and that it uninstalled the affected applications to revoke attacker access. The platform also provided log data to support the developer's investigation.
Master of Malt said that passwords and credit card details were stored separately and were not compromised. The retailer is now warning customers to be wary of phishing emails, spam, and scam phone calls that could exploit the stolen personal information. It has also set up a dedicated page for technical updates and advised customers to contact the company directly if they receive unsolicited requests for sensitive data.