Tixel (Melbourne ticket resale marketplace) tells users their email addresses and mobile numbers may have been accessed after its third-party analytics provider Metabase was breached; passwords, card details and tickets unaffected
Tixel, the Melbourne-based second-hand ticket marketplace, emailed users on the night of Friday 28 August 2026 to say their email address and mobile number may have been accessed after its third-party analytics provider, Metabase, was 'briefly accessed by an unauthorised party', 7NEWS reported on 29 August. Tixel said passwords, credit card and payment information and purchase history were not affected and that accounts, tickets and listings were unaffected, and warned users to watch for spam and phishing that pretends to come from Tixel. Metabase's own post-incident write-up (27 August) says a Metabase Cloud customer reported a suspicious API key on 3 August, that the attack used a previously unknown ('zero-day') vulnerability patched in releases on 6 August, that under 3% of its cloud customers were compromised (as were some open-source users and self-hosted customers with publicly accessible instances), and that Metabase believes the attack required significant large-language-model capabilities. Tixel has not said how many users are affected. Mathspace's breach of about 1.08 million Australian and New Zealand records through a self-hosted Metabase install is a separate card. Source: 7NEWS (29 Aug 2026), quoting Tixel's customer email. Correction (22 Oct 2026): an earlier version said Metabase put the attack on 3 August and the impact at just under three per cent of all its customers; Metabase's own post says 3 August is when a cloud customer reported suspicious activity and that under 3% of its cloud customers were compromised. (source: https://www.metabase.com/blog/vulnerability-what-happened)
- Exploited in Australia?
- unknown
- Patch to
- Tixel users: expect targeted phishing by email, SMS or phone that mentions Tixel or tickets; Tixel says it will never ask for your password or payment details by email or text. Organisations using Metabase Cloud or self-hosted Metabase: confirm you are on the patched release and review Metabase's notice.
Primary: 7NEWS — Data breach hits ticket resale website Tixel (29 Aug 2026) · Vendor: Metabase — August 2026 vulnerability post