Information on a security incident in our former online shop

As of: 23 October 2026

This information is intended for persons who placed orders in our online shop shop.sentix.de between November 2017 and February 2026.

If you never ordered there, you are not affected by this incident. This expressly applies also if you take part in the sentix survey, use our research services or are a client of sentix Asset Management: these systems are technically separate from the shop and were not involved at any time.

We notified all affected persons known to us by e-mail on 23 October 2026. Where the e-mail could not be delivered, we are additionally notifying them by post.

What happened

In June 2026, unknown attackers exploited a security vulnerability in an add-on component of the shop software and gained access to the shop server. The purpose of the attack was to serve third-party advertising pages to search engines under our internet address.

We detected the attack on 13 August 2026 and shut the shop down the same day. It has been permanently decommissioned since then and will not be brought back online.

Which data may be affected

The shop held order data: name and, where applicable, company, billing and delivery address, e-mail address, telephone and, where applicable, fax number, tax or VAT number, order history including items, amounts, dates and payment method, and the IP address used when ordering.

Payment data is not affected. Payments were processed by Stripe and PayPal; we held only transaction references from these providers. Card numbers and bank details were not stored in the shop.

Passwords are likewise not affected. The shop did not maintain customer accounts; all orders were placed as guest orders.

What we know about a possible data leak

For several weeks, the attackers had the technical ability to access the order database. Whether they did so cannot be established conclusively.

The logs available to us argue against an extraction of the order data; the volumes recorded there are many times too small for that. For the period from mid-June to the end of July 2026, however, no logs exist. We therefore cannot rule out that access took place, and we are notifying you as a precaution.

No indications of actual misuse have come to our attention to date.

What risks exist

Should data have been leaked, there is a risk that third parties may use it for particularly convincing fraud attempts. Because name, address and specific past orders are available together, messages can be created that appear highly genuine — for instance purported payment reminders or demands relating to an order that actually took place.

As far as we are aware, there is no risk to your accounts, cards or logins, as no such data was stored in the shop.

What you can do

• Be sceptical of e-mails, letters or telephone calls referring to an order placed with sentix — in particular payment demands, reminders or refund offers.
• Do not click links and do not open attachments in such messages.
• Do not disclose payment or access data.
• If in doubt, call us on +49 6431 59786-04. We will tell you whether a message genuinely came from us.

We will never ask you for access data, payment data or personal details by e-mail in connection with this incident, and we will not send you any payment demand.

What we have done

• Shut down the shop on the day of discovery and permanently decommissioned it
• Carried out a full investigation of the incident
• Changed all affected access credentials
• Reported the incident to the Hessian Commissioner for Data Protection and Freedom of Information on 14 August 2026
• Filed a criminal complaint against persons unknown on 19 August 2026
• Extended log retention and adjusted our procedures for security updates

Questions

For questions about this incident and to exercise your rights under the General Data Protection Regulation, you can reach us at datenschutz@sentix.de and +49 6431 59786-04.

Our external data protection officer is heyData GmbH, reachable at datenschutz@heydata.eu. You also have the right to lodge a complaint with a data protection supervisory authority.

sentix GmbH, Mainzer Straße 4b, 65550 Limburg an der Lahn, Germany