Republik reveals user-data breach after analytics-tool attack

Republik says attackers accessed user data for roughly two months through a vulnerable analytics tool. The Zurich-based online magazine disclosed the breach after one of its analysis tools stopped working on Wednesday morning, October 14. Taking the system offline also cut off the attackers' access, according to the magazine.

Republik said the vulnerability had been known since August 6, yet the necessary protective measures were not implemented quickly enough. The magazine has not identified who was behind the intrusion. Its initial assessment points to a broad, automated campaign that searched exposed Metabase installations for valuable information.

The disclosure affects more than paying readers. Republik said the attackers reached records associated with active publishers, subscribers, newsletter recipients and all former users. People who only signed up for a newsletter, without ever holding a subscription, are included in the affected group.

The magazine said there is no indication that credit-card details were exposed or that the attackers selected Republik specifically. The incident nonetheless places personal information held by a prominent Swiss media organisation in the hands of unknown actors.

The exposed system was Metabase, an analytics platform used to examine data inside an organisation. Republik said attackers first searched for the contents of Metabase installations across the internet. Their apparent targets included login details and keys for artificial-intelligence services, information that can potentially be resold or reused in further attacks.

That pattern shaped Republik's preliminary assessment: the intrusion appears to have been part of an automated wave rather than a campaign aimed specifically at the magazine. The publication does not know the attackers' identity, and the source report provides no evidence that the stolen information has been used against readers.

The access persisted from August until the tool stopped operating in mid-October. Republik's decision to take Metabase offline removed the attackers' route into the installation. The magazine then completed an initial assessment before notifying Switzerland's federal data-protection authority.

The episode illustrates how a compromise in an auxiliary service can expose information held by a media company, even when the service is not the publication's main website. Analytics tools often sit behind editorial and commercial operations, where they can connect multiple categories of user records.

The compromised records contained identity and contact details, not just subscription information. Republik said the data included email addresses and names, as well as telephone numbers where users had supplied them. Some records also contained year of birth and gender.

The scope reaches across the magazine's relationship with its audience. Active publishers and subscribers were affected, but so were newsletter recipients and former users. A newsletter sign-up alone could therefore place a person's details in the compromised dataset. The source report does not provide a total number of affected records.

Republik has not reported evidence that credit-card information was accessed. The magazine also said there was no indication that it had been specifically targeted. Those statements narrow what is currently known, while leaving users exposed to possible follow-up attempts using the leaked contact information.

Readers and former readers should treat unexpected messages that invoke Republik, subscriptions or newsletters with caution. They should avoid opening unsolicited links and should verify requests through the magazine's official channels. The available information does not establish that any such secondary fraud has occurred, so users should distinguish practical caution from confirmed consequences.

Republik acknowledged that it knew about the security flaw on August 6 but did not act in time. The admission is central to the magazine's account of the incident. It explains why the breach continued for weeks after the vulnerability became known, while also identifying the point at which the organisation failed to introduce countermeasures.

The magazine discovered the end of the incident when an analysis tool stopped working on Wednesday morning. It then took Metabase offline, cutting the attackers' access. Republik said it carried out an initial damage assessment before reporting the case to the Federal Data Protection and Information Commissioner on Thursday, October 15.

The authority's involvement places the breach within Switzerland's data-protection framework. The source report does not describe any enforcement action, findings or additional instructions from the commissioner. It also does not say whether affected users received individual notifications.

Republik's public statement gives users several confirmed facts: the categories of data involved, the groups affected, the approximate period of access and the absence of known credit-card exposure. It does not identify the perpetrators or establish how the stolen records may have been handled after the intrusion.

Republik's next task is to clarify the impact for every affected group and explain what users should do. The magazine has removed the vulnerable analytics tool and completed an initial review, but the public account leaves several details open, including the number of records involved and whether individual users will receive direct notification.

For Swiss media organisations, the incident highlights the security risks created by connected services outside the visible publishing platform. Analytics systems can hold information about readers, contributors and prospective subscribers. A weakness in one component can therefore widen the consequences of an intrusion beyond the tool's immediate purpose.

The breach also carries a practical warning for anyone who has interacted with Republik, including people who only received its newsletters or once held an account. Those users should be alert to convincing messages that use their name, email address or knowledge of their relationship with the magazine. They should report suspicious communications through official channels and avoid sharing passwords or payment details.

Republik's investigation, its communication with the federal commissioner and any further user notices will determine how much more becomes known about the incident. For now, the confirmed exposure concerns personal profile and contact data, with no reported evidence of stolen credit-card information.