Bootlegger CEO Ricky Ruthenberg. (Source: Ricky Ruthenberg’s LinkedIn page)
Bootlegger Coffee Company has confirmed that business and personal information was exposed through an internal operations dashboard that had not been fully decommissioned after the company migrated to a more secure environment.
Group CEO Ricky Ruthenberg says the company became aware of a potential data concern on the afternoon of Thursday, 15 October. This involved a legacy version of BOS, an internal operations dashboard previously used for café support scheduling, trade reporting, store visit reports and action item management.
“The company’s IT and governance teams acted immediately, and the legacy platform was taken fully offline the same day,” Ruthenberg says.
He explains that Bootlegger had already migrated BOS to a secure environment, but historical data remained on the previous platform, which had not been fully decommissioned.
“An initial review has established that certain information on the legacy platform was not protected by its login.”
See also
The exposed information includes business performance data, café pipeline information, Google listing details and business contact information, including franchisee and operator names and e-mail addresses, as well as general managers’ names and mobile numbers.
Ruthenberg says no customer data was collected on the platform and customers are therefore not at risk. “To date, there is no evidence that Bootlegger’s databases or core business systems were accessed. The company’s IT teams are continuing their review to confirm this.”
Bootlegger says it will notify the Information Regulator in line with its obligations under the Protection of Personal Information Act and is contacting the franchisees, operators and managers whose details were affected.
A Wayback Machine capture from 2 September shows Bootlegger’s BOS dashboard hosted on Railway, with a username and password login.
An archived version of the BOS dashboard, captured by the Internet Archive’s Wayback Machine on 2 September, shows the Bootlegger-branded application hosted on cloud deployment platform Railway, with a login screen requiring a username and password.
The archived page does not establish whether sensitive information was accessible without authentication at the time.
The disclosure comes as Bootlegger pursues an artificial intelligence (AI) adoption programme championed by Ruthenberg, who has publicly detailed his enthusiasm for vibe-coding and the development of business applications using AI.
In a LinkedIn post on 1 July, Ruthenberg describes how he moved from being an AI sceptic to experimenting with Anthropic’s Claude, building applications and automations through natural-language prompts.
A still of a video promoting Bootlegger showing an outlet. (Source: Bootlegger)
“That night I broke Claude, and honestly I didn’t stop… (every night that week) I was up vibe-coding, watching videos, building anything I could think of, breaking it and building it again… from a few chat prompts to real automation and use cases in hours.”
Ruthenberg says he subsequently mandated Claude for his 15 direct reports and opened access to other office employees on an opt-in basis.
The company also introduced weekly sessions during which employees shared what they had learned about the technology. “Six weeks later, 50+ Claude enterprise accounts floating around and a constant ‘can I get more tokens’ murmur in the office… we are well on our way.”
Ruthenberg says AI has changed how employees work and challenged traditional software development models. “AI has completely levelled that playing field,” he writes, referring to the cost and complexity of software integrations.
“The value going forward sits in the data they hold of yours and the way they translate it and the services around it they offer… but software itself will soon become free, I am almost certain.”
Ruthenberg’s statement does not specify whether the legacy BOS dashboard was developed using AI. He says Bootlegger takes the protection of information entrusted to it seriously and will provide further updates as its review progresses.