Online magazine Republik suffers extensive user data breach via Metabase vulnerability

A security flaw in the Metabase analytics platform allowed unknown actors to obtain a read-only snapshot of Republik's user database over a period of roughly two months. The intrusion was detected after an atypical error message displayed user email addresses and credentials, prompting Republik to shut down the tool the same day and inform the Swiss data-protection and information commissioner. The exposed records cover every active and former user, containing personal identifiers such as email, name, phone number, birth year, gender, and, where available, mailing address and subscription details.

Sample queries also reached comment sections, survey responses, and voting data linked to user accounts. No full credit-card numbers, CVVs, or passwords were compromised, as the service uses email login links. Republik emphasized the risk of targeted phishing messages and stated that no evidence of data sale or public release has emerged, while it prepares a criminal complaint.