WiziShop
ModerateConfirmedDigital services
WiziShop informed its customers that a malicious third party had exploited a security flaw to download a large volume of invoices issued since 2009 under its WiziShop, Dropizi and Evolup services. The company states it was alerted on 17 August 2026, fixed the vulnerability the same day, and reported the incident to France's data protection authority (CNIL). Exposed invoices may contain the customer's name, postal address, customer number, and billing references, dates and amounts; WiziShop states that banking details, login credentials and passwords were not affected.
The combination of a real customer number, an invoice reference and an exact amount could let a third party craft highly credible fraudulent messages, for example to redirect a payment to a different bank account.
- Disclosed on
- September 10, 2026
- Incident dated
- August 17, 2026
- Sector
- Digital services
- Country
- France
- Cause
- Misconfigured database
Exposed data
- Full name
- Postal address
- Customer ID
- Order history
- Employment data
You are only affected if you had an account or an order with this organisation.
What you can do
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact