Two French merchants had their breach notifications made public on 29 August 2026, and both point to a data analytics tool. Easypara names Shipp, the provider that sends delivery-tracking messages on its behalf. The merchant traces the incident to a previously unknown vulnerability in Metabase, the analytics tool Shipp uses. Frères Toque, on the same day, refers to "an external tool used to analyse its data", naming neither the software nor a provider. Both notifications rule out banking data, in different words. Easypara says "no banking data is affected"; Frères Toque says "no banking information, no login credentials and no passwords were compromised".
At Easypara, a provider between the buyer and the flaw
The chain in question at Easypara has three links. The merchant collects contact details when the order is placed. The notification provider, which handles shipping updates, receives the customer’s first and last name, the email address and, where it was given, the phone number, together with the delivery context of the order. The analytics tool that provider uses queries those records. The flaw sits in that tool, it was exploited at the provider, and it exposes the merchant’s customers. Frères Toque describes no such intermediary, and its notification lists other categories, including the order history and the postal address.
An Easypara buyer has no contract with Shipp or with the publisher of Metabase. Under the GDPR, the merchant remains the data controller and answers to its customers for the leak, while Shipp is its processor under Article 28. Metabase adds no further link to that contractual chain, because it is analytics software that Shipp uses, and the flaw sits in that software. The merchant’s payment service provider appears nowhere in the chain, which explains why no card data figures among the exposed records.
An SQL injection on the forgotten-password endpoint
SQL injection means slipping a fragment of a query into a field meant to hold a value, so the database runs it as code. The Metabase vulnerability, referenced CVE-2026-72898 by The Hacker News, affects the /api/session/reset_password endpoint. That endpoint stays reachable without authentication by design, because it serves the person who can no longer log in. The attacker injects SQL there and gains administrator access without ever presenting a credential, which earns the flaw a CVSS score of 10 out of 10.
The calendar puts the event on a scale. Wiz counts about 2,500 Metabase instances reachable from the internet, across the 13% of cloud environments running the tool self-hosted, a quarter of which are fully exposed. The figure missing from both French notifications is the number of people affected.
What an order history is worth to a fraudster
The order history is one of the categories Frères Toque says were exposed. A genuine purchase history tied to a phone number feeds two authorised push payment scams. The first is the fake refund. The caller poses as the merchant’s customer service team, quotes the exact order with its date and amount, reports a delivery problem, then offers a refund that takes a few steps inside the banking app. Those steps send a credit transfer to an account the fraudster controls.
The second scam is the fake delivery notice. A message claims customs or redelivery charges on a parcel the recipient really is waiting for, with a payment link. These campaigns pay off because the message matches what the recipient expects, since the parcel is on its way and the recipient ordered it. Stolen tracking data supplies that match.
| Card payment data | Contact details and order history | |
|---|---|---|
| Revocability | A CB CB card number can be blocked and the card reissued within days. | A name, a phone number and a past order cannot be revoked. |
| Useful life | Until the card is blocked, so hours to days. | Several months, with credibility fading as the order ages. |
| Fraud route | Unauthorised transaction, executed without the cardholder. | Authorised transaction, initiated by the customer who was talked into it. |
| Customer remedy | Refund of the unauthorised transaction, Article L. 133-18 of the French Monetary and Financial Code. | No general right to a refund, since the customer gave consent. |
The French legal framework
The GDPR requires the data controller to report a breach to the supervisory authority within seventy-two hours under Article 33. Article 34 requires it to inform the individuals concerned when the risk to their rights and freedoms is high. Frères Toque has filed with the CNIL. The Easypara notification relayed on 29 August mentions no such filing.
French payment law separates the two situations described above. An unauthorised transaction gives the payer a right to a refund from the payment service provider under Article L. 133-18 of the Monetary and Financial Code. A credit transfer the customer authorised personally, even under manipulation, falls outside that regime. Since 9 October 2025, Regulation (EU) 2024/886 has required verification of payee, which compares the name the payer types with the account holder’s name and flags a mismatch without blocking the transfer.