Privacy Unpacked

Confirmed breach

Mittwald CM Service data breach

DEGermany

The Record reported a data breach at Mittwald CM Service (Germany) on 9 November 2026, and it has been confirmed.

People affected
Not reportedno count given yet
Reported
9 November 2026News report

What was exposed 1

  • Customer data

How it happened

How
Software flaw the attackers exploited a flaw in Mittwald's Model Context Protocol (MCP) server source
Way in
MCP server exploited a flaw in Mittwald's Model Context Protocol (MCP) server used to allow customers to connect their AI assistants to mStudio source

Sources 1

News reports are read by an AI model; every fact taken from an article was checked word for word against it, and anything it could not find was dropped. · Corrections and changes

Questions about the Mittwald CM Service breach

Was Mittwald CM Service hacked?

The Record reported a data breach at Mittwald CM Service (Germany) on 9 November 2026, and it has been confirmed. How it happened, by the sources: software flaw, through MCP server.

What data was exposed in the Mittwald CM Service breach?

Customer data, by the notices and reports on this page.

How do I know if I was affected?

Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.

Is there a Mittwald CM Service data breach settlement?

No settlement open for claims is on record for Mittwald CM Service as of 15 November 2026. Every open settlement is listed with its deadline.

Is a letter, email or text about the Mittwald CM Service breach real or a scam?

A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Mittwald CM Service’s own site, or check the letter here.

More breaches in Germany

  1. AfDreportedDEGermany · 11 November 2026 Personal data –not reported
  2. Universität LeipzigreportedDEGermany · 11 November 2026 Email addressesPhone numbers –not reported
  3. Universität TübingenreportedDEGermany · 11 November 2026 Personal data –not reported
  4. Sonnenpark WillingenreportedDEGermany · 10 November 2026 Guest data 1Kguests
  5. Technische Universität MünchenreportedDEGermany · 6 November 2026 Passwords and loginsPhone numbersDates of birth+7 52Kstudents

Every breach in Germany →

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.