UK online spirits retailer Master of Malt has confirmed that attackers spent four days inside its customer data after compromising Ribon, a third-party app connected to its BigCommerce storefront. Founder Justin Petszaft emailed affected customers directly, writing: "I'm sorry to say that the attackers had access to your name, email address, phone number, and address." The unauthorised access window ran from 13 to 17 September 2026. No source, including the retailer's own notification, has published a record count or a number of affected customers, and BigCommerce has not said how many merchants were caught up in it.
What Happened
The intrusion did not begin at Master of Malt. According to the retailer's customer notification, seen by The Register, BigCommerce alerted the company that Ribon, an app it had installed on its BigCommerce store, had been hacked, and that attackers had obtained a BigCommerce application key held by Ribon. With a valid key in hand, the attackers queried customer data as though they were the legitimate app.
BigCommerce confirmed the credential compromise on 17 September 2026, per Merchant Fraud Journal, Hitechub, BreachHistory and TechRadar, all of which cite a BigCommerce statement given to BleepingComputer. That statement, as quoted by Hitechub, refers to credentials for both "Ribon and Ribon 1.5, owned and operated by Fastr's 'Be A Part Of'." Master of Malt says BigCommerce's security team uninstalled the affected app the same day and "assured us there is no ongoing compromise and no further customer data can be accessed."
Timelines across the sources are broadly consistent but differ in precision. The Register and Master of Malt's own notification give the window as 13 to 17 September. SafeState, an OTHER-tier source, publishes tighter bookends of 17:21 BST on 13 September to 21:12 BST on 17 September; no PRIMARY or established outlet has corroborated those timestamps, so treat them as unconfirmed detail rather than established fact. SafeState also reports that the founder's email to customers went out on the evening of 18 September, a few hours after BigCommerce notified the retailer.
One wrinkle worth flagging for anyone tracking coverage: the two Register URLs in the source set are the same Carly Page report published under two headlines, one framing the story around Master of Malt and the other around BigCommerce. They are one piece of reporting, not two independent confirmations.
What Was Taken
Master of Malt told customers the exposed fields are names, email addresses, phone numbers and postal or shipping addresses. That set is consistent across every source in the file, including the retailer's direct quote.
Explicitly not taken, per both Master of Malt and BigCommerce: account passwords, credit card details and other payment information. Both parties say those are held in a separate system that was not touched. BigCommerce has also stated that its own platform and core systems were not breached and that the incident was confined to the compromised third-party application.
Volume is the open question. Nobody has published a figure. There is no record count from Master of Malt, no merchant count from BigCommerce, and no estimate from any outlet in the source set. TechRadar notes for scale only that a late-2024 SEC filing put BigCommerce at 5,884 accounts with at least one enterprise plan subscription, and that a 2025 press release claims "tens of thousands" of B2C and B2B companies across 150 countries. Those are platform-wide numbers, not breach numbers, and should not be presented as exposure estimates. TechRadar states plainly that it is not known how many stores use Ribon.
Merchant Fraud Journal and TechRadar both report that Master of Malt filed with the UK Information Commissioner's Office. That is consistent with GDPR obligations for this data category, but it comes from OTHER-tier sources rather than an ICO confirmation.
Why It Matters
This is a textbook SaaS supply chain failure, and the shape of it is more instructive than the size. Master of Malt did nothing wrong at the platform level. Its passwords were segmented, its card data was segmented, its store was hosted on a mainstream platform. It was still breached, because a marketplace app it had installed to optimise the shopping experience held an API key that the attacker stole.
The practical lesson is about trust inheritance. Once the attacker held a valid Ribon key, BigCommerce's platform had no basis to distinguish malicious requests from legitimate ones. SafeState puts it well: the platform treated every request as legitimate. Authorisation was working exactly as designed. The design was the problem.
The second-order risk is the one Master of Malt is warning its customers about directly. Name, email, phone and delivery address is a complete enough profile to run high-quality fraud without any card data. A scam call or phishing email that correctly cites a customer's recent delivery address and a niche whisky purchase is far more convincing than generic spam. The retailer is telling customers to be "extra vigilant" against phishing emails, spam and scam calls, and that guidance is the correct read of the exposure.
There is also an unresolved element that defenders should not skip past. Merchant Fraud Journal, SafeState, BreachHistory and Hitechub all report, citing BigCommerce's statement to BleepingComputer, that the stolen credentials were used not only to read shopper data but to inject malicious scripts into a small number of retail storefronts. SafeState notes that neither BigCommerce nor the app's owner has explained what those scripts did. Script injection into a checkout-adjacent storefront is the classic precondition for card skimming, and until the function of those scripts is disclosed, the payment-data-was-safe framing rests on the assumption that the affected storefronts and the skimming risk do not overlap. No source has linked Master of Malt specifically to the script injection activity.
The Attack Technique
The initial compromise vector remains unexplained. Nobody has said how the Ribon application key was stolen from Be A Part Of or Fastr. The Register asked BigCommerce how many merchants and customers were affected, what access the compromised key provided, how it was stolen, and whether any other third-party applications were affected, and reported it had not received a response. Be A Part Of and Fastr have not commented publicly, per SafeState.
What is described consistently is the post-compromise chain:
- Attackers obtained valid BigCommerce application credentials belonging to the Ribon and Ribon 1.5 apps.
- They used that key to make authorised-looking API calls against merchant environments, pulling shopper records across multiple retailers.
- In parallel, per BigCommerce's statement to BleepingComputer as relayed by four OTHER-tier sources, they injected malicious scripts into a small number of merchant storefronts.
- BigCommerce confirmed the compromise on 17 September, uninstalled the apps from affected stores to revoke access, notified affected merchants directly, and began supplying log data to the app developer's investigation.
Ribon is one of more than 1,200 third-party apps and integrations in the BigCommerce marketplace. No threat actor attribution has been offered by any party, and no group has claimed the intrusion. Treat this as unattributed.
What Organizations Should Do
- Inventory every app holding an API key against your storefront. Enumerate installed marketplace apps, what scopes each one holds, and which ones can read customer PII. Most merchants have never audited this list, and the Ribon case shows a conversion-optimisation tool can hold read access to your entire customer database.
- Scope keys down to what the app actually needs. A storefront experience tool should not have bulk read access to customer records. Where your platform supports granular scopes, apply least privilege and remove any grant the app does not demonstrably use.
- Alert on anomalous API read volume per application key. The distinguishing signal here was not a bad credential, it was a legitimate credential behaving abnormally over a four-day window. Baseline normal per-key query volume and rate, and alert on deviation.
- Verify storefront script integrity. Given the reported script injection, review deployed storefront JavaScript against a known-good baseline, and implement Content Security Policy and Subresource Integrity so an app-injected script cannot silently reach checkout fields.
- Rehearse third-party breach notification now. Master of Malt was dependent on BigCommerce to detect and notify, then had hours to draft customer comms and file with the ICO. Pre-write the notification template and confirm who in your organisation owns the regulator filing decision.
- Contract for disclosure, not just uptime. Vendor agreements should require timely breach notification, log access and post-incident technical detail. The unanswered questions in this incident, including how the key was stolen and what the injected scripts did, are exactly the gaps that contractual terms are supposed to close.
- Brief customer-facing staff on the phishing wave. Anyone exposed should expect targeted phishing and voice scams referencing real order details. Tell customers what your organisation will never ask for, and expect impersonation attempts against your own support channels.
Sources: Whisky merchant Master of Malt confirms customer data spilt | BigCommerce app breach spills Master of Malt customer data | Third-Party App Breach Hits BigCommerce Shopper Data - Merchant Fra... | BigCommerce warns customers of potential data leaks ... - TechRadar | BigCommerce Merchants Hit by Data Breach via Ribon App | BigCommerce Ribon Apps Breach: Shopper PII Exposed — BreachHistory | BigCommerce Warns Merchants of Data Breach Linked to Ribon App - Hi... | Master of Malt Data Breach: Hackers Steal Customer Details via Comp...