Master of Malt Security Review: BigCommerce App Key Breach Exposed Customer Data
In short
Master of Malt confirmed a customer data exposure in September 2026 after a compromised BigCommerce app key allowed access to names, emails, and addresses for roughly four days.
Master of Malt security review covers a September 2026 incident in which attackers used a stolen BigCommerce application key to access customer information on the UK spirits retailer’s storefront. The breach lasted from September 13 to September 17 and stemmed from the Ribon app rather than any flaw in BigCommerce itself. Passwords and payment details remained protected throughout the event.
Master of Malt Security Review: Timeline and Scope of the Incident
BigCommerce detected the unauthorized access through its monitoring of the Ribon app and notified Master of Malt on September 18. The retailer immediately revoked the key, uninstalled the app, and sent notification emails to affected customers the same afternoon. It also filed a report with the UK Information Commissioner’s Office under case reference IC-569770-Y1R9.
The exposed data included names, email addresses, phone numbers when provided, and billing or shipping addresses. Order details and some delivery addresses were not reached by the attackers. No passwords or card information stored through Braintree were accessible via the compromised key.
Master of Malt founder Justin Petszaft stated that the company added new access alerts, conducted full app audits, and began monitoring for injected scripts. BigCommerce supplied logs of the activity and removed the Ribon app from all connected stores on September 17.
E-commerce Security Risks Highlighted by the BigCommerce App Key Breach
The incident shows how third-party applications can create entry points even when the core platform remains secure. Fastr, the company behind Ribon, confirmed the key originated from its own systems and stated that hundreds of BigCommerce stores had installed the app. The exact number of affected Master of Malt customers has not been disclosed.
Businesses that rely on external apps face several practical risks. Keys can be stolen through upstream compromises, and page-by-page data scraping can occur before detection. In this case the window lasted approximately 100 hours.
- Review all connected apps and revoke unused API keys on a quarterly schedule.
- Enable logging for every external integration and set alerts for unusual data volume.
- Store payment credentials only with PCI-compliant processors that are isolated from storefront apps.
- Notify customers promptly and file required regulator reports within legal timeframes.
BigCommerce emphasized that merchants remain responsible for vetting third-party tools. Master of Malt has since implemented stricter controls on API permissions and script monitoring to reduce similar exposure in the future.
| Data Category | Status | Notes |
|---|---|---|
| Names and emails | Exposed | Downloaded during the four-day window |
| Addresses | Partially exposed | Billing and some shipping addresses reached |
| Passwords | Not exposed | Stored separately and unreachable |
| Payment details | Not exposed | Handled by Braintree outside the key scope |
As of mid-October 2026 no further public updates on the Fastr investigation or additional exposures have appeared. Customers should watch for phishing attempts that reference recent purchases and enable two-factor authentication on any linked accounts.
Frequently asked questions
What data did the Master of Malt breach expose?
Attackers accessed names, email addresses, phone numbers when supplied, and billing or shipping addresses. Passwords and payment information stayed protected because they were stored separately.
How long did the unauthorized access last?
The compromised key allowed access from September 13 to September 17 2026, a period of roughly four days or 100 hours before revocation.
Was Master of Malt’s BigCommerce platform itself hacked?
No. BigCommerce stated the incident resulted from a stolen key belonging to the third-party Ribon app and did not involve a breach of its core platform.
What steps should customers take after the incident?
Watch for phishing emails that reference recent orders, enable two-factor authentication on related accounts, and monitor bank statements even though payment data was not accessed.
TrustScope
Comments 12