Follow the Money: Metabase Flaw Exposes Journalism Datasets

Dutch investigative outlet Follow the Money (FTM) has confirmed it was hacked after a group posted on a Turkish hacker forum claiming to have stolen 5,909,601 records from the publication. FTM says the attackers got in through a known, unpatched flaw in the Metabase analytics tool. The company says they reached an environment holding research datasets built from public records, and that no member or reader personal data, email addresses or details of ongoing investigations were taken. The Dutch National Cyber Security Centre (NCSC) alerted FTM to the breach. The claim's headline number is large, but most of it appears to be public data that FTM had collected for its reporting.

What Happened

The forum listing went up on 5 November 2026, according to HIFY Radar and Undercode News. Both described the group as advertising a dump of 5,909,601 records that combined a "reader/subscriber export" with research datasets on company registrations, political party financing and state aid. When those reports were published, FTM had not commented and nobody had checked the claim.

FTM's own account fills in the timeline. On Thursday morning, 5 November, the NCSC told the outlet about the breach. FTM says it "immediately took the relevant database offline" and opened an investigation into the cause and extent of the intrusion. It published its statement the next day under the headline "Follow the Money was hacked. Your data is safe."

The incident is now confirmed by the victim itself. No regulator filing or law enforcement statement has been published, and the leaked material has not been independently analysed in public. The listing is unrelated to the leak-site activity of The Gentlemen extortion group, which heise and Cybernews reported in October against MoneyGram, Deloitte, KFC and others.

What Was Taken

The two accounts differ sharply on what the data contains.

What the attackers claim: 5,909,601 records, including a reader and subscriber export plus research datasets. Undercode News gave the figure as 5.9 million in its article but "59 Million" in its headline. The forum listing itself says about 5.9 million, so the larger number looks like a typo.

What FTM says: The exposed environment held a database used for journalism projects. Examples include European Parliament voting patterns, political donations, data on Russia's shadow fleet, and information from the Dutch commercial register. FTM stresses that this is all publicly available. The voting records come from the European Parliament's website, the donation data comes from the member states' own publications, and much of it is already gathered by projects such as HowTheyVote.eu and Donation.watch.

The "readers" file: The main point of dispute is a database named lezers_extract ("lezers" is Dutch for "readers"). From the name, the attackers presented it as a customer export, and HIFY Radar called it the main risk for subscribers. FTM says it "turned out to be an empty dashboard with no underlying data." FTM is the only party that has examined its own systems, and its statement is the most authoritative account available. Unless someone produces evidence to the contrary, the reader-data claim should be treated as unsupported.

The 5.9 million figure counts rows of data, not people. Undercode News made the same point: the number reflects the volume of records, not unique individuals or compromised accounts. As HackedWire's verification guide puts it, an attacker's claim is where an investigation starts, not where it ends. Attackers have a clear incentive to inflate their numbers.

Why It Matters

Little sensitive data was exposed here, but the case still matters for three reasons.

1. Who the victim is. FTM investigates corruption, financial crime and sanctions evasion, including the Russian shadow fleet. Any intrusion into a newsroom's data systems raises the question of whether sources or unpublished stories could be exposed. FTM says details of ongoing investigations were not reached. The next attackers may find a less tidy setup.
2. Misleading file names cause real harm. A file called "readers_extract" was enough to start public reports of a subscriber breach. Organisations should expect attackers to use file names as marketing, and should be ready to state quickly and specifically what each exposed file actually contains.
3. Slow patching of analytics tools. FTM admits the Metabase flaw "was already known in August" and that it "did not implement a security update quickly enough." Self-hosted business intelligence and analytics tools often sit outside normal patch cycles, yet they connect directly to databases.

The response is worth noting too. The national CERT alerted the victim, the database was taken offline the same day, and a public statement naming the attack vector, the data exposed and the data not exposed followed within about a day. HackedWire's verification guide describes exactly this kind of specific statement as the most useful signal in breach reporting.

The Attack Technique

According to FTM, the attackers exploited a known vulnerability in Metabase, which the outlet uses to store and analyse certain datasets. That gave them access to the environment containing the journalism database. A fix had been available since August 2026, but FTM had not applied it. FTM has not named the specific CVE, and its statement does not say whether the attackers moved beyond that environment. The outlet says only that "that part of our databases is now secure again."

No group has been publicly named beyond the forum poster, and no motive has been established. The attackers appear to have presented whatever was reachable in the Metabase-linked environment as a breach of a major media outlet.

What Organizations Should Do

1. List every Metabase instance and patch it. Find all self-hosted Metabase deployments, including ones set up by data or newsroom teams outside IT, and bring them up to the current release. Treat any instance that missed the August 2026 update as possibly compromised.
2. Take analytics tools off the open internet. Put BI dashboards behind SSO, a VPN or a zero-trust access proxy. A database front end has no reason to be publicly reachable.
3. Limit what analytics tools can reach. Give Metabase and similar tools read-only, narrowly scoped database accounts. Keep customer, subscriber and source data in separate environments from research datasets, as FTM appears to have done.
4. Clean up misleading assets. Delete or rename empty dashboards, test exports and placeholder tables whose names suggest sensitive content. They make extortion claims more believable and make your response harder.
5. Prepare a precise disclosure template. Have a statement ready that covers the attack vector, the systems affected, the data categories exposed and, just as important, what was not exposed. Being specific is what makes a disclosure believable.
6. Monitor forums and leak sites for mentions of your organisation. In this case the national CERT spotted the listing first. Organisations should watch for themselves as well, so they hear about a claim from their own team before they hear about it from the press.

Sources: Follow the Money was hacked. Your data is safe - Follow the Money -... | Cybercriminals claim data leak at Confluent, Deloitte, KFC and Mone... | Follow the Money: Actor claims leak of… HIFY Radar | Follow the Money Allegedly Breached: Threat Actors Claim Exposure o... | How to Verify a Data Breach: A Field Guide for Skeptics HackedWire | MoneyGram ransomware claim: Gentlemen gang threatens data leak Cyb... | Following the money: the playbook behind the $6.3bn Binance heist a... | Bank, brokerage and mortgage breach notices: what financial firms t...