Master of Malt says stolen credentials for a third-party shopping application exposed customer contact details, while BigCommerce says it revoked the application’s access.
Master of Malt warned customers that attackers accessed names, email addresses, phone numbers and postal addresses using a compromised Ribon application credential. Its notice places the incident between September 13 and 17 and says passwords and payment information were not exposed. The retailer said it notified affected customers on September 18 and reported the breach to the UK Information Commissioner’s Office.
In September 21 reporting, BigCommerce told BleepingComputer that it had removed the affected application and revoked access on September 17. The company said its platform had not been breached and that it was providing logs for the developer’s investigation.
Master of Malt urged shoppers to watch for suspicious calls and messages. The number of affected people and the fate of any copied information remain unclear. Customer notice.
Layer8’s Cybersecurity offering could support a scoped review of integration permissions, followed by agreed corrective work and validation. For a merchant, that could mean limiting each app’s access to the customer information its job requires and assigning someone authority to revoke that access. Supplier escalation would be agreed where the merchant cannot remove access directly.
A controlled check would confirm that approved functions still work, prohibited access fails and revocation removes access. Together, those controls could reduce exposure and shorten containment. The benefit would depend on the permissions the platform supports and the response authority agreed with suppliers; it would not establish that copied information had been recovered.