E-Commerce ERP Provider Mallbic Hosts Hit by Unauthorized Malicious Commands; Shopline Rotates API Keys

What Happened

According to Mallbic's statement, anomalous host logs were discovered during daily security checks on October 31, prompting early-morning incident response that confirmed unauthorized execution of malicious commands on certain hosts; the primary entry point was patched on the afternoon of October 30 and reported to competent authorities ^[1]. Brands using its services, including "Gogo Energy" and "BeRule", stated that written notices from the vendor indicated their databases had been queried and subjected to attempted ^[1].

Scope of Impact

Attackers entered the system via a brand website service portal, meaning potentially affected data is not limited to brand websites and also includes consumer and transaction records imported by merchants from other e-commerce platforms; the exact data fields and merchant scope remain under investigation ^[1]. Shopline stated that it has no direct contractual relationship with third-party ERP vendors chosen by merchants and only provides API connectivity, adding that while its own platform was not compromised, it has proactively rotated the relevant API keys ^[1].