Hackers Abuse Stolen BigCommerce App Key to Steal Master of Malt Customer Data
Attackers used a stolen Ribon BigCommerce app key to access Master of Malt customer contact data.
Master of Malt said attackers used a stolen application key for Ribon, a third-party BigCommerce app owned by Fastr and managed by Be A Part Of, to read customer records. Access ran from 17:21 BST on September 13 to 21:12 BST on September 17, 2026, when the key was revoked; BigCommerce notified the retailer on September 18. Exposed data included names, email addresses, phone numbers, and physical addresses, but not passwords or payment details. The company reported the incident to the UK ICO under reference IC-569770-Y1R9 and said Ribon, used across many stores, appeared to be the primary target.
- A stolen Ribon app key accessed BigCommerce data from September 13 to 17, 2026.
- Exposed data included names, emails, phone numbers, and physical addresses.
- Passwords and payment card details were not accessed.
- Master of Malt notified the UK ICO under case reference IC-569770-Y1R9.
- The retailer says Ribon, used by many stores, was the likely primary target.
- ATT&CK
- T1528 Steal Application Access TokenT1078.004 Cloud AccountsT1213 Data from Information Repositories
- Vendors
- BigCommerce
- Products
- BigCommerceRibon
- Victims
- Master of Malt
- Countries
- United Kingdom
From the original article
3 min read at gbhackers.com
Master of Malt reported a customer data breach after attackers allegedly compromised an application key linked to Ribon, a third-party BigCommerce app managed by Be A Part Of that identifies itself as a Fastr brand. BigCommerce notified the retailer of the incident on September 18, 2026, prompting Master of Malt to reach out to affected […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.