---
title: "Data breach at Citadium"
description: "Citadium informed some of its customers that a cyberattack against its order-tracking and delivery-notification provider, Shipup, had allowed unauthorized access to part of their personal data. Shipup reported the exploitation of a vulnerability in its Metabase analytics tool (CVE-2026-72898) to Cit"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-08-citadium
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-08
dateModified: 2026-09-08
---
# Citadium

Data breach — Moderate

Citadium informed some of its customers that a cyberattack against its order-tracking and delivery-notification provider, Shipup, had allowed unauthorized access to part of their personal data. Shipup reported the exploitation of a vulnerability in its Metabase analytics tool (CVE-2026-72898) to Citadium on August 20, 2026, as part of a campaign that also affected other retailers using the same provider. The exposed data includes names, email addresses and phone numbers; no passwords or bank data were involved. Citadium notified the CNIL on August 25, 2026 and sent a notice to affected customers on September 8, 2026.

The exposed contact details (names, emails, phone numbers) increase the risk of targeted phishing attempts impersonating Citadium or a delivery carrier.

| Fact | Value |
| --- | --- |
| Disclosed on | September 8, 2026 |
| Incident dated | August 20, 2026 |
| Sector | Retail |
| Country | France |
| Cause | Third-party provider |
| Severity | Moderate |
| Status | Confirmed |

## Exposed data

- Full name
- Email address
- Phone number

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Citadium (Shipup)](https://frenchbreaches.com/alertes/citadium-shipup-mtu3vt912q1i17on3ex) — FrenchBreaches
- [Citadium : des informations clients récupérées lors de la cyberattaque contre Shipup](https://www.cyberattaque.org/citadium-des-informations-clients-recuperees-lors-de-la-cyberattaque-contre-shipup/) — Cyberattaque.org
- [Fuite de données chez Citadium suite à un incident chez un prestataire](https://fuitesinfos.fr/article/2026-09-09-citadium) — Fuites Infos

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-08-citadium
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees