Attackers access Lego Certified Stores SA customers' personal data with zero-day

Jan

Jan

Who's the Boss?
Staff member
Joined
May 24, 2010
Messages
14,881
Reaction score
13,564
Location
The Rabbit Hole
Lego Certified Stores South Africa hit by zero-day hack of third-party database provider

Personal information of Lego Certified Stores customers in South Africa was exposed following the breach of a reporting tool used by the company that operates its loyalty and marketing programme.

Lego Certified Stores South Africa sent an email to customers on Friday, 14 August 2026, notifying them of the breach and offering advice on precautionary measures they could take.
 
Most likely this 0day.

thehackernews.com

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase says a CVSS 10.0 zero-day SQL injection was exploited in the wild; the flaw can grant admin access and expose connected database data.
thehackernews.com thehackernews.com

Get's a max rating of 10.

The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain administrator access to the instance.
Click to expand...

sql injection 🤬
 
We have Lego stores in SA?

Never seen one before, or is this only in larny shopping malls?
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X