Master of Malt was not hacked. An app plugged into its shop was.
Every add-on you connect to your online shop, your accounts package, or your customer database holds a key to it. That is how it works: the reviews widget needs to see orders, the email tool needs the customer list, the loyalty app needs both. You approved each one with a click, probably some time ago.
Each of those keys works whether the app is still doing anything useful for you or not. And each one is looked after by a company whose security you have never seen.
Last month a UK retailer found out what that means in practice.
What happened
Master of Malt, the online drinks retailer, has told customers their details were taken, according to an email seen by The Register. Its shop runs on BigCommerce, an e-commerce platform. Connected to that shop was a third-party app called Ribon.
Attackers compromised Ribon and got hold of the application key it held for the store. With that key they read customer data between 13 and 17 September: names, email addresses, phone numbers, and postal addresses. Passwords and payment details were not taken. The retailer says those are kept in a separate system.
Master of Malt did not discover this itself. BigCommerce told it, and BigCommerce's security team uninstalled the app the same day.
Several things are still unknown. The Register asked BigCommerce how many other shops were affected, what the key could access, and how it was stolen, and had not had an answer when it published.
The lesson is in what did not happen
Nobody broke through Master of Malt's defences. No member of staff clicked a bad link. Its passwords and card data sat safely somewhere else. By the usual measures, the retailer did its part.
The data left anyway, through a door it had opened on purpose and then had no way to watch.
This is how most online businesses are put together now. The shop, the website, the accounts system, and the customer database each have a marketplace of add-ons, and connecting one takes a minute. Disconnecting one almost never happens. The trial that ended, the tool a former colleague set up, the integration replaced by something better: they tend to stay connected, with their keys still working.
When one of those suppliers is breached, the customers affected are yours. So is the awkward email. You decided what to collect and who to share it with, and UK data protection law treats those decisions as your responsibility even when a supplier is the one that slipped.
One thing Master of Malt did well
The notification is worth a look, because most are worse. The founder apologised in the first person and said plainly what was taken: "the attackers had access to your name, email address, phone number, and address". He said what was not taken, and why. He warned customers to expect scam calls and phishing, and told them the company would never ask for passwords or payment details by phone or email.
No "we take your security seriously". No "a limited number of customers". If you ever have to write that email, that is the standard to aim for.
What to do
- Find the list. Every platform has a page showing the apps and integrations connected to it. Open it for your shop, your accounts package, your CRM, your email marketing tool, and your Microsoft 365 or Google Workspace. Most people have never seen this page.
- Remove what you do not use. If nobody can say what an app is for, disconnect it. This is the single most useful ten minutes on the list.
- Look at what each remaining app can read. Many ask for more than they need. An app that only prints shipping labels has no reason to hold your full customer history. Where the platform lets you narrow the access, narrow it.
- Ask who would tell you. Master of Malt heard from its platform. Check that the contact address on each supplier account goes to a person who still works for you and reads it.
- Write down who owns the list. Somebody should review connected apps when a member of staff leaves and once a year regardless. It does not need a policy. It needs a name.
- Draft the awkward email before you need it. You do not need the full text. Know who would write it, who would approve it, and where your customer list is.
How Steelwise can help
Working out which outside companies hold a key to your customer data, and which of them still need it, is a short and practical piece of security advisory work. Get in touch if you would like help with it.