The incident exposed customer email addresses and mobile numbers.
Lego Certified Stores South Africa has confirmed a data breach after hackers exploited a zero‑day vulnerability. Picture: The Citizen/Faizel Patel
Lego Certified Stores South Africa has confirmed a data breach after hackers exploited a zero‑day vulnerability in Metabase, a third‑party reporting tool.
It is believed the incident, which occurred on 5 August, exposed customer email addresses and mobile numbers, though no banking details or passwords were compromised.
Breach
Lego sent an email to customers on Friday, notifying them of the breach and offering advice on precautionary measures they could take.
“As a result of the breach, the email addresses and mobile telephone numbers of some of its customers were accessed by an unauthorised actor,” My Broadband reported
“The incident arose from a security vulnerability in Metabase, a third‑party reporting tool used internally by Marsello.”
Warning
While the company stressed that financial information remains secure, it warned customers to be alert for phishing attempts.
“Impacted customers may receive an increase in unsolicited, scam or phishing emails and text messages.
“Please contact your nearest Lego Certified Store to verify if this communication is from us or not,” the retailer advised.
Risks
The breach highlighted the growing risks posed by third‑party software vulnerabilities, with attackers exploiting flaws before patches are widely deployed.
Lego Certified Stores said it is reviewing security and access controls with service providers to strengthen protections.
Marsello confirmed that no further unauthorised access has been detected since the patch was applied, and believes further breaches are “highly unlikely”.
Still, the company urged vigilance, noting that exposed contact details could be misused by cybercriminals.
Advice
Customers are advised to avoid clicking suspicious links, signing into unfamiliar websites, or sharing sensitive information via email or SMS.
The retailer emphasised that official communications should always be verified directly with stores.
The incident underscores the importance of robust cybersecurity in retail operations, particularly where customer loyalty and engagement platforms rely on external providers.
Outa attacked
Last month, the Organisation Undoing Tax Abuse (Outa), best known for defeating Gauteng’s e‑tolls, was crippled by a cyberattack that hijacked its Meta advertising account and cut off a vital channel for its anti‑corruption campaigns.
Outa CEO Wayne Duvenage said the attack compromised their advertising account with Meta platforms, the owner of Facebook.
“Fortunately, we detected the breach early, and there were losses from the abuse of our account, but it was limited, so the breach had nothing to do with customers’ names, and it was just that account that we used to promote our work on Facebook.”
Duvenhage explained that after the breach, Meta allegedly “restricted” Outa’s account.
