Citadium
ModerateConfirmedRetail
Citadium informed some of its customers that a cyberattack against its order-tracking and delivery-notification provider, Shipup, had allowed unauthorized access to part of their personal data. Shipup reported the exploitation of a vulnerability in its Metabase analytics tool (CVE-2026-72898) to Citadium on August 20, 2026, as part of a campaign that also affected other retailers using the same provider. The exposed data includes names, email addresses and phone numbers; no passwords or bank data were involved. Citadium notified the CNIL on August 25, 2026 and sent a notice to affected customers on September 8, 2026.
The exposed contact details (names, emails, phone numbers) increase the risk of targeted phishing attempts impersonating Citadium or a delivery carrier.
- Disclosed on
- September 8, 2026
- Incident dated
- August 20, 2026
- Sector
- Retail
- Country
- France
- Cause
- Third-party provider
Exposed data
- Full name
- Email address
- Phone number
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact