Black Phoenix Alchemy Lab

Black Phoenix Alchemy Lab, operating under aliases including BPAL and blackphoenixalchemylab.com, is an online retailer headquartered in the United States. The company specializes in selling products via its e-commerce platform, facilitating transactions through third-party payment processors like AuthorizeNet. Its primary market involves direct-to-consumer sales through digital channels, serving customers who purchase goods electronically. The organisation manages customer profiles and administrative systems to support its retail operations, reflecting a standard e-commerce business model focused on online order fulfillment and payment processing.

In May 2018, the organisation experienced a cyberattack involving malicious code injection into its website checkout page. This compromise specifically targeted credit card transactions processed through AuthorizeNet, potentially exposing payment details, billing addresses, contact information, and security codes for fewer than 150 customers during a limited timeframe. Although the retailer did not store credit card data due to established practices, attackers created an unauthorized administrative account, indicating broader risks to customer profile access. The incident highlighted vulnerabilities in the transactional infrastructure despite adherence to data minimization principles.

The organisation responded by neutralizing the malicious code immediately and enforcing password resets for administrative accounts. It migrated to a secured server environment and eliminated fraudulent user accounts. Law enforcement agencies were engaged to investigate the breach, and potentially affected individuals received direct notifications. These actions demonstrated a focus on containment and remediation following the security event, addressing both technical vulnerabilities and potential data exposure risks through coordinated measures.