Legalstart
ModerateConfirmedDigital services
Legalstart, a French online legal services platform, detected on September 9, 2026 the exploitation of a critical vulnerability (CVE-2026-72898) in Metabase, an internal data analysis tool. The flaw allowed an attacker to bypass authentication and extract data belonging to some clients. The exposed information includes name, email address and phone number; the company states no passwords, banking details or identity documents were identified among the extracted data. The incident was reported to the CNIL on September 14, 2026, and a criminal complaint was filed for unauthorized access to an automated data processing system.
The exposed contact details allow a third party to run targeted phishing campaigns by impersonating Legalstart or an organization tied to its administrative processes (bank, tax authority, social agencies).
- Disclosed on
- September 22, 2026
- Incident dated
- September 9, 2026
- Sector
- Digital services
- Country
- France
- Cause
- Misconfigured database
Exposed data
- Email address
- Full name
- Phone number
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact