Dodo Payments Breach: Metabase Hack Hits Merchants

August 16–20, 2026: Dodo Payments confirmed an attacker exploited CVE-2026-72898 in a self-hosted Metabase analytics server and viewed internal merchant reporting datasets during a short window. The payments platform says card data, API keys, dashboard passwords, and payment processing were not touched; PCI DSS Level 1 remains valid. Affected merchants will be notified directly — no public headcount yet. Canonical: dodo-payments-metabase2026. Sources: Dodo Payments notice, Metabase advisory, Ransomware.live (DireWolf listing).

Merchant-of-record platforms sit in an awkward spot when BI tools leak. Customers never chose your Metabase instance — they chose a checkout button — but reporting warehouses often hold enough merchant PII to power convincing “payout failed, re-enter your bank details” fraud. Dodo’s notice is unusually explicit about what stayed out of scope; it is also honest that merchant information in analytics was in scope.

What happened: Dodo Payments data breach timeline

Dodo Payments says it became aware of unauthorised access on August 16, 2026. Co-founder Ayush Agarwal published a summary on LinkedIn the next day; the company’s security blog (updated August 20) is the canonical technical account.

According to that notice, an unauthorised third party reached a self-hosted Metabase deployment used only for internal business analytics. The attacker exploited CVE-2026-72898, a critical flaw in Metabase (tracked as GHSA-vwf4-m7j8-wcjf) that allows authentication bypass via SQL injection against POST /api/session/reset_password. Dodo states the exploit required no Dodo Payments credential — no password, MFA factor, or merchant API key was compromised to get in.

Response actions Dodo lists: contained access within hours, upgraded Metabase to a patched release, restricted the vulnerable endpoint, revoked sessions and OAuth tokens on the affected system, rotated internal API keys (including any created by the attacker), and preserved forensic evidence. Payments, payouts, dashboard, and APIs stayed up — the status page shows routine maintenance, not an August 16 outage tied to this event.

One day before the company disclosure, Ransomware.live indexed a DireWolf leak-site entry for “DodoPayments” (discovered August 15, 2026, financial-software sector). Dodo’s public write-up does not confirm ransomware encryption or a mass public dump at catalog time; treat DireWolf marketing as unverified scope unless samples or a regulator filing appear.

How the Metabase attack worked

August 2026 turned Metabase into a supply-chain headache. Metabase CEO Sameer Al-Sakran disclosed that Metabase Cloud was hit with the same class of zero-day; self-hosted customers had to patch manually. The attack pattern is consistent across victims BreachHistory tracks:

• Unauthenticated SQLi on the password-reset API path.
• Attacker gains Metabase instance admin.
• Admin access exposes stored credentials for connected databases and whatever reporting tables those connections can read.
• Detection signature Metabase published: POST /api/session/reset_password → 400 followed quickly by GET /api/user/current → 200 from the same source.

Dodo Payments is explicit that Metabase sat on a separate path from card processing — but BI tools are only as safe as the data stores they can query. The company’s remediation plan acknowledges that: removing direct internet exposure from internal analytics, SSO + IP allow lists on admin interfaces, and re-architecting how reporting tools connect to underlying databases.

What was exposed in the Dodo Payments breach?

Dodo’s “What was affected” section is careful and incomplete in the way honest early notices often are:

• Reporting datasets available to the compromised Metabase instance were viewed and queried during a “short, clearly bounded period.”
• The company has identified that information relating to some merchants was involved.
• It is still determining specific data categories, which merchants, and which individuals — and will contact affected merchants directly.

That language usually means analytics replicas or warehouse tables with merchant business metadata — names, emails, transaction summaries, product SKUs, geography, payout status, or support notes — rather than live card numbers. Dodo has not published a field list yet. Do not assume end-customer (shopper) card data leaked because a payments brand was named; wait for your merchant letter or Dodo’s follow-up blog edits.

What was not exposed (per Dodo Payments)

To be clear about what the company denies:

• Payment authorisation, transaction processing, and settlement systems were not accessed.
• Full payment card numbers — card processing runs through payment service providers; cardholder data does not reside in the affected environment per Dodo.
• Merchant API keys, dashboard passwords, and account credentials — not stored in the Metabase system that was hit.
• Merchant funds — not accessed or put at risk.
• Service availability — no downtime or degradation on payments, payouts, dashboard, or APIs.
• PCI DSS Level 1 certification — unaffected according to the notice.

Those boundaries matter for compliance teams deciding whether this is a cardholder-data incident vs a merchant-privacy incident. They do not mean “no breach” for merchants whose reporting rows were readable.

Who is at risk after the Dodo Payments hack?

SaaS founders and merchants on Dodo Payments

If you process subscriptions or digital goods through Dodo, you are the primary audience. Until you get a direct notice, assume your business metadata might have been visible in analytics if Dodo’s warehouse mirrored your account. Watch for:

• Phishing that cites your real product name, MRR band, or recent payout amount.
• Fake “Dodo Payments compliance” forms asking for API keys or OTPs.
• Impersonation of Dodo support on Telegram or X DMs — the company says official mail comes only from @dodopayments.com.

End customers of Dodo merchants

Dodo has not said shopper PII was in the Metabase datasets. Many merchant-of-record stacks segregate buyer card data from BI replicas, but segregation fails in messy ways. End users should not panic; merchants should not over-promise until Dodo’s merchant-specific notices land.

Engineering and security teams running self-hosted Metabase

Dodo’s post doubles as a patch advisory. If you still expose Metabase to the internet on a vulnerable build, you are in the same threat model as Framework, Tally, TeleCoop, ShipMonk merchants, and now Dodo. Patch floors include Metabase 0.63.5, 0.62.9, 0.61.11, 0.60.17, 0.59.21, or 0.58.24 (or matching Enterprise builds). If you cannot patch immediately, block /api/session/reset_password at the edge and rotate every database credential Metabase can reach.

Metabase campaign context — why Dodo Payments matters

The August Metabase wave is one of the clearest “forgotten admin tool” stories of 2026. BreachHistory already catalogs related confirmed incidents:

• Framework — customer names, emails, addresses, phones stolen from Metabase on August 3.
• Tally (tally.so) — emails and password hashes from analytics Metabase.
• TeleCoop — confirmed customer PII access via Metabase auth bypass.
• ShipMonk — fulfillment partner breach path that hit Trezor and other merchants.
• Metabase vendor disclosure — the Cloud zero-day that framed the whole cluster.

Dodo fits the pattern: a high-trust fintech runs a popular OSS analytics package on an internet-reachable host, connects it to rich business data, and discovers too late that CVSS 10.0 means “unauthenticated admin.” The difference is Dodo’s payment rail stayed up — a relief for checkout uptime, not a guarantee that reporting copies were empty.

Dodo also names other Metabase victims in its LinkedIn guidance — Framework, Tally, n8n, Kilo Code, Checkly, and Scalingo — underscoring that this was a horizontal campaign, not a one-off probe against a single Indian fintech.

DireWolf listing vs company confirmation

Ransomware leak sites often list victims before legal approves a blog post. DireWolf’s August 15 entry for DodoPayments does not, by itself, prove encryption, double extortion, or a 60 GB dump — BreachHistory does not treat leak-site headlines as attested counts. What is attested is Dodo’s admission that someone queried internal analytics and that merchant-related information is under review.

If you see forum posts selling “Dodo Payments full database,” treat them as unverified until Dodo or a regulator confirms fields and volumes. Rotate credentials if you reused passwords, but do not pay “delete my data” scammers.

What Dodo Payments said — and what is still pending

The company apologised, promised a full technical investigation, and listed structural fixes: no direct internet on internal analytics, WAF + SSO + IP allow lists on admin UIs, formal patch SLAs for self-hosted third-party software, expanded auth logging, and independent assessors reviewing remediation. SOC 2 and ISO 27001 work was already underway before the incident.

Still open at publishing time:

• Numeric count of affected merchants or individuals.
• Exact field types in the reporting datasets.
• Whether shopper/end-customer records were included.
• Law-enforcement or regulator filings in India, EU, or US states.
• Whether DireWolf’s listing reflects the same intrusion or parallel noise.

Questions can be directed to [email protected] per the notice.

Was I affected by the Dodo Payments data breach?

Merchants: wait for email from @dodopayments.com. If you have not heard by early September 2026 and you are an active Dodo customer, ask through official support channels — not a link in a random Slack forward.

Shoppers: no action required unless your SaaS vendor later tells you buyer data was in scope.

Metabase operators: patch or isolate today; hunt logs for the reset_password → user/current pattern.

What to do after the Dodo Payments breach — action items

1. Merchants: pre-register dodopayments.com in your mail client; ignore password/API/OTP requests elsewhere.
2. Optional hygiene: Dodo says API keys were not taken, but rotating Dodo API keys and dashboard passwords is reasonable if you want belt-and-suspenders assurance.
3. Engineering: review what your Metabase (or Looker, Superset, etc.) instances can reach — treat BI admin as production-root access.
4. Phishing drills: brief finance and support staff that accurate payout figures in an email do not prove legitimacy.
5. Contract review: check your DPA/subprocessor notices for how Dodo will handle merchant notifications and timelines.
6. Self-hosted Metabase: upgrade to a patched release; revoke sessions; rotate connected DB passwords; remove public ingress if analytics does not need it.
7. Do not download alleged “Dodo leak” archives from forums — they may be malware or recycled old dumps.

Why merchant-of-record breaches feel different

Dodo Payments positions itself as merchant of record for global SaaS — handling tax, fraud, and compliance so founders can ship faster. That concentration is efficient until an internal analytics box becomes the soft underbelly. Attackers do not need to touch Stripe’s card vault if they can read a warehouse table listing every merchant’s payout IBAN, product catalog, and chargeback rate.

PCI scope separation is real and Dodo leans on it heavily in this notice. Privacy and fraud teams should still model merchant confidentiality and competitive intelligence loss from reporting access — especially for small teams whose revenue metrics never appeared in a public filing.

Comparing Dodo Payments to other fintech incidents in 2026

This is not the first payments-adjacent analytics miss of the year. Travala disclosed customer passports and hashed passwords via regulator filings. Carhartt shows how fast actor dumps hit HIBP even when the retailer stays quiet. Dodo’s case sits in the middle: company-confirmed access, no card data attested, merchant impact still being tallied.

For searchers asking “was Dodo Payments hacked” — yes, in the narrow sense the company confirms: internal Metabase was compromised and merchant reporting data was queried. No, in the sense that payments kept working and PCI card environments were not breached per the notice.

PCI scope vs merchant privacy — why both matter

Security teams sometimes talk past each other on fintech incidents. “PCI was not impacted” is a precise statement about cardholder data environments and assessor scope. It does not automatically mean “no regulated personal data left the building.” Merchant names, support tickets, revenue cohorts, and tax identifiers in a reporting database can still trigger GDPR, India DPDP, or state privacy notice duties depending on whose records were mirrored into Metabase.

Dodo’s notice is careful to separate those worlds — a good sign for auditors, but merchants should still loop in counsel when the direct email arrives. If your DPA with Dodo requires breach notification within a fixed window, start the clock from your receipt of their merchant notice, not from the August 17 LinkedIn post.

What merchants should expect in a Dodo Payments notice

Based on how comparable fintech analytics breaches have played out in 2026, a merchant-specific letter may include:

• Whether your account’s reporting tables were in the queried datasets.
• Categories of fields exposed (business contact, payout metadata, product catalog, transaction aggregates, etc.).
• Whether any end-customer (shopper) rows were reachable from the compromised connection.
• Remediation steps Dodo has taken on the analytics plane.
• A contact path for follow-up questions — likely [email protected] or a dedicated incident alias.

Until that letter lands, avoid telling your own customers “you were not affected” unless you know your buyer data never sat in Dodo’s warehouse replicas. Many SaaS teams only learn the answer from the processor’s forensic inventory.

Log hunting for security teams

If you operate Metabase anywhere in your stack — whether or not you use Dodo — August is the month to grep web logs. Metabase’s published detection pair is:

• POST /api/session/reset_password returning HTTP 400.
• GET /api/user/current returning HTTP 200 from the same client within seconds.

That sequence is not proof of exploitation by itself, but it is a high-signal lead for incident responders. Combine it with new admin users, fresh API keys inside Metabase, or unexpected JDBC connection tests against production read replicas.

Dodo says it identified and documented infrastructure used by the unauthorised party to assist authorities. That suggests traditional law-enforcement engagement, not merely a bug-bounty report — another reason to treat merchant outreach seriously when it arrives.

Phishing scenarios to rehearse with finance

Accurate context makes fraud easier. After analytics leaks, attackers often skip generic “your account is locked” templates and cite numbers that feel internal:

• “Your August payout of $4,218.33 failed KYC — verify your bank account in this portal.”
• “Dodo Compliance: API key rotation required before September 1 — paste your live secret here.”
• “Chargeback spike on SKU X — download the attached CSV to dispute.”

Train accounts payable and founder-operators to confirm payout changes only inside the authenticated Dodo dashboard you bookmarked before the incident — never through links in email or Telegram.

Canonical record and sources

Catalog: dodo-payments-metabase2026 — recordsAffected 0 pending merchant census. Related Metabase wave: Framework, Metabase zero-day blog.

Primary sources: Dodo Payments security incident blog; Metabase GHSA-vwf4-m7j8-wcjf; BleepingComputer on Framework/Tally; Ransomware.live DireWolf listing (unverified scope).

Search coverage: Dodo Payments data breach, Dodo Payments hack 2026, Dodo Payments Metabase CVE-2026-72898, merchant of record breach, was Dodo Payments hacked, Dodo Payments API keys safe, fintech analytics breach, what to do Dodo Payments incident.