---
title: "Cypress Metabase Cloud data incident"
description: "Cypress Metabase Cloud data breach: verified timeline, impact and response through October 7, 2026."
incident_type: "Data incident"
status: "active"
last_modified: "2026-10-07"
canonical_url: "https://www.ally.security/incidents/cypress-metabase-cloud-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/cypress-metabase-cloud-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/cypress-metabase-cloud-data-incident-2026/stix.json"
---

# Cypress Metabase Cloud data incident

Cypress reported unauthorized queries against its Metabase Cloud instance.

Last modified Oct 7, 2026 · 3 sources

## Summary

- **Environment:** Metabase Cloud analytics instance
- **Operational impact:** Cypress reported test execution was unaffected
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Cypress](https://www.cypress.io/) reported unauthorized queries against its [Metabase](https://www.metabase.com/) Cloud instance. [2](#source-2)

## Impact

Accessible information included account data, build metadata and, for some customers, tokens and recorded test content. [2](#source-2)

Cypress said test execution and results were unaffected. [2](#source-2)

## Timeline

### July 31, 2026 — Unauthorized queries

Attacker activity reported by Metabase to Cypress. [2](#source-2)

### August 6, 2026 — Cypress notified

Metabase informed Cypress. [2](#source-2)

### August 7, 2026 — Customer notifications

Affected organizations were notified. [2](#source-2)

### October 7, 2026 — Briefing updated

This briefing was last reviewed and updated on October 7, 2026.

## Threat Group & Attack Vector

Cypress attributed access to a previously unknown Metabase vulnerability. [2](#source-2)

Metabase described SQL injection that created administrative sessions. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Cypress rotated credentials, revoked sign-in authorizations and commissioned independent forensic review. [2](#source-2)

Metabase patched Cloud instances and released fixes on August 6. [3](#source-3)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/cypress-metabase-cloud-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### August 2026 Security Vulnerability: What happened?

official · Metabase · Aug 27, 2026

<https://www.metabase.com/blog/vulnerability-what-happened>

<a id="source-2"></a>

### Cypress Security Incident: Status and Response

official · Cypress.io · Aug 13, 2026

<https://www.cypress.io/blog/cypress-security-incident-status-and-response>

<a id="source-3"></a>

### Security update available for Metabase - Please upgrade now

official · Metabase · Aug 6, 2026

<https://www.metabase.com/blog/security-update-6-aug-2026>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Cypress reported unauthorized queries against its Metabase Cloud instance.
2. **Used Product · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Metabase
3. **Discovered At · 100% confidence · current**  
   Cypress Metabase Cloud data breach: 2026-08-06
4. **Affected Organization · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Cypress.io
5. **Resulted In · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Cypress said test execution and results were unaffected.
6. **Exposed Data Category · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Account credentials
7. **Resulted In · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Cypress attributed access to a previously unknown Metabase vulnerability.
8. **Resulted In · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Cypress rotated credentials, revoked sign-in authorizations and commissioned independent forensic review.
9. **Resulted In · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Metabase described SQL injection that created administrative sessions.
10. **Occurred At · 100% confidence · current**  
   Cypress Metabase Cloud data breach: 2026-07-31
11. **Disclosed At · 100% confidence · current**  
   Cypress Metabase Cloud data breach: 2026-08-07
12. **Resulted In · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Metabase patched Cloud instances and released fixes on August 6.
13. **Resulted In · 100% confidence · current**  
   Cypress Metabase Cloud data breach: Accessible information included account data, build metadata and, for some customers, tokens and recorded test content.

</details>