Master of Malt began alerting customers this week after learning that Ribon, an application integrated with its BigCommerce-powered online store, had been hacked. In an email seen by The Register, the retailer's founder Justin Petszaft stated that attackers obtained a BigCommerce application key held by Ribon and used it to access customer data over a four-day window.
The compromised information includes names, email addresses, phone numbers, and physical addresses. However, Master of Malt confirmed that passwords, credit card details, and other payment information were stored in a separate system that was not affected by the breach.
Ribon is owned and operated by Be A Part Of, which Master of Malt described as a Fastr brand. BigCommerce alerted Master of Malt to the incident, informing the retailer that Ribon had been compromised. According to the notification, BigCommerce's security team uninstalled the affected app on the same day and assured the retailer that "there is no ongoing compromise and no further customer data can be accessed."
The Register has reached out to BigCommerce for additional details regarding the number of merchants and customers impacted, the specific access the compromised key provided, the method of theft, and whether other third-party applications were affected. No response has been received as of publication.
Master of Malt is cautioning affected customers to remain vigilant against potential phishing emails, spam, and scam phone calls that could exploit the stolen data. The retailer emphasized that it will never request passwords or payment details via email or phone and urged customers to report any suspicious requests directly. A dedicated page has been set up for further technical details and updates, rather than sending repeated emails.