Master of Malt breach exposes customer data via third-party app

UK-based online whisky retailer Master of Malt has confirmed a data breach affecting its customer database, following the compromise of a third-party application integrated with its e-commerce platform. The incident exposed personal details but spared payment information, according to notifications sent to affected customers this week.

What happened

Attackers gained access to Master of Malt’s customer data through a compromised application key belonging to Ribon, a third-party app connected to the retailer’s BigCommerce store. The breach occurred over a four-day period in mid-September, during which hackers extracted names, addresses, phone numbers, and email addresses. Master of Malt founder Justin Petszaft informed customers that passwords and payment details were not accessed, as these are stored in a separate, unaffected system.

BigCommerce, the e-commerce platform provider, detected the incident and alerted Master of Malt. The company’s security team subsequently uninstalled the compromised Ribon app, revoking the attackers’ access. BigCommerce later clarified that the breach stemmed from a system compromise at Fastr, the parent company of Ribon’s developer, Be A Part Of. The attackers used the stolen API credentials to inject malicious scripts into a limited number of merchant storefronts, though BigCommerce emphasized that its own systems and platform remained secure.

Why it matters

The incident highlights the risks of third-party integrations in e-commerce environments, where a single compromised application can expose customer data across multiple merchants. While BigCommerce acted swiftly to contain the breach, the event underscores the need for merchants to vet the security practices of app developers, particularly those handling sensitive data. Master of Malt has warned customers to remain vigilant against phishing attempts, spam, and scam calls leveraging the stolen information, as such data is frequently used in follow-up attacks.

BigCommerce’s response—uninstalling the affected app and notifying merchants—reflects a growing trend among platform providers to take proactive measures when third-party vulnerabilities emerge. However, the breach also raises questions about the oversight of app developers, especially those under larger corporate umbrellas like Fastr, which owns Ribon’s developer, Be A Part Of. The source of the initial compromise at Fastr remains unclear, and neither Fastr nor Be A Part Of have publicly commented on the incident.

What to watch

Merchants using BigCommerce or similar platforms should review their third-party app integrations, particularly those developed by smaller or less-established providers. The incident may prompt e-commerce platforms to tighten security requirements for app developers, including stricter API credential management and regular audits. For affected Master of Malt customers, the retailer has set up a dedicated page for updates, advising them to avoid clicking links or sharing personal details in unsolicited communications.

The breach also serves as a reminder for businesses to segment customer data, ensuring that payment information and personal details are stored in separate, isolated systems. While Master of Malt’s approach prevented financial data from being exposed, the incident demonstrates how quickly a single vulnerability can escalate into a broader security issue for both merchants and their customers.