Cyber attack on Ribon compromises BigCommerce, impacts Master of Malt

Online spirits retailer Master of Malt suffered a supply chain breach after its e-commerce provider BigCommerce was compromised through a vendor-side attack on Ribon Applications.

 

Headquartered in Tonbridge, Kent, Master of Malt is an online spirits retailer and independent bottler specializing in whisky, gin, rum and other fine spirits. The company uses BigCommerce as its core cloud e-commerce platform to support its online operations and customer experience.

 

In a data security incident notice published on its website, Master of Malt said it recently received an email from BigCommerce informing the company that one of its third-party applications, “Ribon,” which is owned, managed, and operated by “Be A Part Of,” which in turn describes itself as a “Fastr” brand, has been a victim of a significant data security incident.

 

According to the information shared by BigCommerce, Ribon suffered a security breach between September 13 and 17 after threat actors used a compromised application key to access stored customer data. The exposure lasted around 100 hours until BigCommerce’s engineering and security teams disabled the compromised credential.

 

The compromised information included the names, email addresses, phone numbers, and addresses of Master of Malt customers. However, the company confirmed that cybercriminals did not gain access to passwords, credit card details, or other payment information, as these are stored in a separate system that was not affected by the incident.

 

“Please be extra vigilant against potential phone calls, SPAM and phishing attacks targeting you using the stolen data, and question anyone asking you to click a link or share data. We will never contact you to ask for any payment details or passwords over email or phone so please treat any email or phone call which claims to be from us asking for these details as suspect,” Master of Malt said.

 

The incident has also been reported to the UK Information Commissioner’s Office (ICO), the country’s independent data protection regulator responsible for overseeing compliance with data protection and privacy laws.

 

Master of Malt said BigCommerce confirmed the attack was no longer ongoing and that the company was not specifically targeted. The attackers targeted Ribon, a third-party application installed on hundreds of BigCommerce stores, and used a compromised Ribon access key to access data stored within BigCommerce’s systems.

 

“We will be working with BigCommerce to ensure that they implement more granular access control via their API, as no 3rd party application should have been able to access customer data in this way,” Master of Malt added.