GreenGo
ModerateConfirmedRetail
GreenGo, a French accommodation booking platform, suffered unauthorized access between August 9 and September 7, 2026 to an internal data analysis tool built on Metabase, exploited through a vulnerability in that software as part of a wider campaign affecting other organizations. The access was discovered on September 7 and cut off the same evening. Data potentially viewed includes names, dates of birth, email addresses, phone numbers, booking and stay information, reviews, favorites, in-platform messages, and, for gift card holders, the associated message, amount, recipient and code. No payment card data is involved, as payments are handled by a third-party provider.
The combination of identity data, date of birth, phone number and in-platform messages exposes affected individuals to targeted, well-informed phishing or impersonation attempts.
- Disclosed on
- September 10, 2026
- Sector
- Retail
- Country
- France
- Cause
- Misconfigured database
Exposed data
- Full name
- Email address
- Phone number
- Date of birth
- Order history
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- GreenGoFrenchBreaches
- GreenGo victime d'une cyberattaque : données de comptes, réservations et messages consultésCyberattaque.org
- Fuite de données chez GreenGo : réservations et cartes cadeaux des clients concernéesFuites Infos
- Faille Metabase chez GreenGo : ce que doivent décider la plateforme, les hébergeurs et l'éditeurKohen Avocats
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact