Welyb

ModerateConfirmedDigital servicesSeptember 15, 2026

A security incident affected, from 1 September 2026, a technical component interacting with Welyb, a collaborative platform published by AGIRIS (ISAGRI group) and used by accounting firms to centralize documents and electronic invoicing flows with their clients. The exposure includes names, postal addresses, phone numbers, email addresses and hashed passwords, along with associated business data (company name, SIRET/SIREN, business contact details). Welyb/AGIRIS notified the affected individuals and states it neutralized the vulnerability and cut off unauthorized access upon detection. No exposure of electronic invoices or banking data has been reported at this stage.

Linking a person's identity to a specifically identifiable business via its SIRET/SIREN number facilitates targeted phishing attempts impersonating the accounting firm or tax authorities.

Disclosed on: September 15, 2026
Incident dated: September 1, 2026
Sector: Digital services
Country: France
Cause: Misconfigured database

Exposed data

Email address
Full name
Phone number
Postal address
Employment data
Password (hashed)

You are only affected if you had an account or an order with this organisation.

What you can do

Change that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
Turn on two-factor authentication on the affected accounts: a stolen password is then no longer enough.
Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

Sources

Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact