---
title: "Data breach at Legalstart"
description: "Legalstart, a French online legal services platform, detected on September 9, 2026 the exploitation of a critical vulnerability (CVE-2026-72898) in Metabase, an internal data analysis tool. The flaw allowed an attacker to bypass authentication and extract data belonging to some clients. The exposed "
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-22-legalstart
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-22
dateModified: 2026-09-22
---
# Legalstart

Data breach — Moderate

Legalstart, a French online legal services platform, detected on September 9, 2026 the exploitation of a critical vulnerability (CVE-2026-72898) in Metabase, an internal data analysis tool. The flaw allowed an attacker to bypass authentication and extract data belonging to some clients. The exposed information includes name, email address and phone number; the company states no passwords, banking details or identity documents were identified among the extracted data. The incident was reported to the CNIL on September 14, 2026, and a criminal complaint was filed for unauthorized access to an automated data processing system.

The exposed contact details allow a third party to run targeted phishing campaigns by impersonating Legalstart or an organization tied to its administrative processes (bank, tax authority, social agencies).

| Fact | Value |
| --- | --- |
| Disclosed on | September 22, 2026 |
| Incident dated | September 9, 2026 |
| Sector | Digital services |
| Country | France |
| Cause | Misconfigured database |
| Severity | Moderate |
| Status | Confirmed |

## Exposed data

- Email address
- Full name
- Phone number

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Legalstart](https://frenchbreaches.com/alertes/legalstart-muctklh6rpolz3fsiu) — FrenchBreaches
- [Legalstart : une cyberattaque expose les données personnelles de ses clients](https://www.cyberattaque.org/legalstart-une-cyberattaque-expose-les-donnees-personnelles-de-ses-clients/) — cyberattaque.org
- [Legalstart : cyberattaque et fuite de données visant ses clients](https://fuitesinfos.fr/article/2026-09-22-legalstart) — Fuites Infos
- [CVE Record: CVE-2026-72898](https://www.cve.org/CVERecord?id=CVE-2026-72898) — CVE.org

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-22-legalstart
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees