Estonia’s Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) received 123 personal data breach notifications in the third quarter of 2026, a record. According to the regulator, one of the reasons was a set of vulnerabilities in Magento and WordPress found in mid-summer. Several of its examples are online shops.
What did AKI report?
AKI published its quarterly figures on 8 October. Organisations filed 25 notifications in July, 47 in August and 51 in September. In the same quarter of 2025 there were 57, so the number has more than doubled (up 116%). In the second quarter of 2026 there were 66. Of the 123, 25 came from the public sector.
A breach notification is the report an organisation must file itself when personal data it holds has leaked or reached the wrong people.
AKI says the Magento and WordPress flaws discovered in mid-summer were exploited quickly by criminals. The second big driver was a large data leak at a company that supplies treatment software to dental clinics. AKI does not name specific vulnerabilities. Since the flaws were found and quickly exploited, the shops most at risk were probably those that did not update in time.
What happened to the online shops?
AKI describes several cases:
- A cosmetics shop. Attackers used a Magento flaw to break into the shop’s website and install malware.
- A general goods shop. A WordPress flaw was used to add malicious plugins, including a fake Cloudflare verification page.
- A travel booking shop. An attacker used a vulnerability to upload a script to the web server and attack the database.
The fake verification page deserves a closer look. It imitates Cloudflare’s familiar “are you human?” check, which turns a hacked shop into a trap for its own customers.
Not every case was a website flaw. On an online gaming platform, a configuration error left a payment provider’s secret API key in the source code, and it was used to pull customer data. At a software company, a developer’s GitHub account was taken over and used to spread malicious code. And a bank employee uploaded employment contracts to an AI service where other users of the same account could see them.
Why this matters for your online shop
If your shop uses Magento or WordPress, this is about you. In the second quarter AKI had already flagged two online shops that had fallen behind on Magento updates. By the third quarter, AKI named Magento and WordPress flaws as one of the reasons for the record.
As the business that collects customer data, your shop is responsible for it. If it leaks, you must notify AKI within 72 hours of becoming aware of the breach. The clock starts when you find out, not when the attack happened, and AKI has an online form for the notification.
What to do now
- Install Magento or WordPress security updates, including plugin updates, as soon as they are released. Remove plugins you no longer use. If a developer built your shop, agree who installs updates and how quickly.
- Have the site checked for unknown plugins, scripts or files. An unfamiliar plugin or a fake verification page is a sign the site has been taken over.
- Keep secret keys out of the code. If an API key has ended up in code or a public repository, have it replaced straight away.
- Protect developer accounts with two-step login. That includes GitHub and any other code repositories.
- Agree what data staff may upload to AI tools. AKI’s list shows how easily contracts can end up where others can see them.
If a breach has already happened, our incident page lists the first steps. A website security check covers software versions, plugins and leaked keys.
Sources
- Andmekaitse Inspektsioon: Kolmandas kvartalis esitati rekordarv rikkumisteateid
- Andmekaitse Inspektsioon: Isikuandmetega seotud rikkumistest teavitamine 2026. aasta II kvartalis
- Andmekaitse Inspektsioon: Rikkumisteade (breach notification form)
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
