Master of Malt Confirms Customer Data Breach: A Detailed Examination
Master of Malt, a prominent online retailer specializing in spirits, has confirmed a significant breach of customer data, stemming from a compromise of a third-party application integrated with its ecommerce platform. This incident has raised concerns not only about the security of customer information but also highlights the vulnerabilities associated with third-party applications.
The breach occurred when attackers compromised API credentials for Ribon, an application managed by Be A Part Of, which operates under the umbrella of Fastr. From September 13 to 17 in 2025, hackers exploited these credentials to access sensitive customer data. This timeframe, during which the breach took place, allowed the attackers to have unmonitored access to the data for four consecutive days, significantly heightening the risk of customer information being misused.
BigCommerce, the ecommerce platform utilized by Master of Malt, played a crucial role in identifying the breach. Upon discovering the unauthorized access, BigCommerce promptly alerted Master of Malt about the incident and immediately took action by uninstalling the compromised application to prevent further data loss.
In an unfortunate turn of events, the breach was not a direct attack on BigCommerce’s systems but rather a result of the exploitation of third-party application credentials tied to the Ribon and Ribon 1.5 applications. These credentials enabled the hackers to inject malicious scripts into merchant storefronts, thereby gaining unauthorized access to customer databases. This distinction is essential as it underscores the need for greater scrutiny and security measures surrounding third-party integrations.
According to the information disclosed by Master of Malt, the stolen data encompasses critical customer details such as names, email addresses, phone numbers, and physical addresses. Fortunately, the company’s founder, Justin Petszaft, reassured customers that more sensitive data, including passwords, credit card information, and payment details, were not accessed during this breach. This is largely due to the fact that such sensitive information is stored in isolated systems that maintain stringent security protocols.
The breach has impacted an undisclosed number of customers associated with Master of Malt; however, BigCommerce has characterized the situation as affecting "a small number of merchant storefronts." The total number of merchants or customers that may have been affected remains unclear, leading to uncertainty about the full scope of the incident. In an effort to facilitate transparency, BigCommerce has provided log data to assist developers in investigating the breach’s particulars.
In light of the incident, Master of Malt is urging its customers to be vigilant against potential phishing attempts and spam communications that may arise, utilizing the stolen information. The company has emphasized that it will never ask for passwords or payment information via email or phone, thereby encouraging customers to remain skeptical of unsolicited requests for sensitive information. In situations where customers encounter such requests, they are advised to reach out directly to Master of Malt through official communication channels for verification.
To ensure that affected customers stay informed about the evolving situation, Master of Malt has established a dedicated webpage. This proactive measure aims to provide ongoing updates regarding the breach, rather than relying on a potentially overwhelming series of email notifications to impacted customers.
Ultimately, the Master of Malt data breach serves as a stark reminder of the vulnerabilities that permeate the digital landscape, particularly concerning third-party applications. As retailers increasingly utilize integrated platforms to enhance customer experiences, the necessity for rigorous scrutiny and enhanced security measures around third-party applications becomes paramount. The implications of such breaches extend beyond immediate customer concerns, impacting trust and loyalty, and thus, businesses must prioritize robust security solutions to safeguard their customers’ sensitive data against evolving threats in the digital age.
This incident underscores the importance of transparency in communication and the need for both companies and customers to remain vigilant in an increasingly digital marketplace. The challenges posed by third-party integrations will require ongoing attention and improved security practices to protect against future breaches.