Zero‑Day hack exposes Lego Certified Stores SA customer data

The incident exposed customer email addresses and mobile numbers. Lego Certified Stores South Africa has confirmed a data breach after hackers exploited a zero‑day vulnerability in Metabase, a third‑party reporting tool. It is believed the incident, which occurred on 5 August 2026, exposed customer email addresses and mobile numbers, though no banking details or passwords were compromised. Breach Lego sent an email to customers on Friday, 14 August 2026, notifying them of the breach and offering advice on precautionary measures they could take. As a result of the breach, the email addresses and mobile telephone numbers of some of its customers were accessed by an unauthorised actor,” My Broadband reported “The incident arose from a security vulnerability in Metabase, a third‑party reporting tool used internally by Marsello.” Warning While the company stressed that financial information remains secure, it warned customers to be alert for phishing attempts. “Impacted customers may receive an increase in unsolicited, scam or phishing emails and text messages… Please contact your nearest Lego Certified Store to verify if this communication is from us or not,” the retailer advised. Risks The breach highlighted the growing risks posed by third‑party software vulnerabilities, with attackers exploiting flaws before patches are widely deployed. Lego Certified Stores said it is reviewing security and access controls with service providers to strengthen protections. Marsello confirmed that no further unauthorised access has been detected since the patch was applied, and believes further breaches are “highly unlikely.” Still, the company urged vigilance, noting that exposed contact details could be misused by cybercriminals. Advice Customers are advised to avoid clicking suspicious links, signing into unfamiliar websites, or sharing sensitive information via email or SMS. The retailer emphasised that official communications should always be verified directly with stores. The incident underscores the importance of robust cybersecurity in retail operations, particularly where customer loyalty and engagement platforms rely on external providers. Outa attacked Last month, the Organisation Undoing Tax Abuse (Outa), best known for defeating Gauteng’s e‑tolls, has been crippled by a cyberattack that hijacked its Meta advertising account and cut off a vital channel for its anti‑corruption campaigns. Outa CEO Wayne Duvenage said the attack compromised their advertising account with Meta Platforms, the owner of Facebook. “Fortunately, we detected the breach early, and there were losses from the abuse of our account, but it was limited, so the breach had nothing to do with customers’ names, and it was just that account that we used to promote our work on Facebook.” Duvenhage explained that after the breach, Meta allegedly “restricted” Outa’s account.