2026 Dipeeo — 0xSec Metabase claim; ~3k users + GDPR client maps (unverified)
Data compromised
Actor samples/structure: accounts, activities, archives, DPA analyses, subcontractors, Trust Center requests, users (~3k) with names/emails/phones/roles and password field (unverified)
Technical writeup
Unverified Metabase/extortion-style claim — Cyberattaque.org August 25, 2026. Actor 0xSec claimed access to data available via metabase.dipeeo.fr for French GDPR/DPO SaaS Dipeeo, publishing structure for 11 JSON files covering client accounts, legal contacts, activity logs, archives, DPA analyses, subcontractor maps, Trust Center requests, and users.json (~3,000 people with names, emails, phones, roles, last login, and a password field). Dipeeo had not publicly confirmed at indexing. recordsAffected 3000 from actor user count (unverified); companyConfirmed false.
Root cause
Unverified 0xSec claim of data from metabase.dipeeo.fr (Aug 25, 2026); company had not confirmed