On September 8, 2026, Aroma-Zone told some customers that third parties may have viewed names, first names, email addresses and, in some cases, phone numbers in Shipup's environment. The reported unauthorised access ran from July 31 to August 17, 2026.
According to the notice reported by Cyberattaque.org, passwords, orders, delivery information and bank or payment details were not affected. The notice does not confirm that the contact details were extracted and does not state how many customers were involved.
What customer data was reported
The notice lists names, email addresses and phone numbers where provided. Aroma-Zone explicitly excludes passwords, order history, delivery details and bank or payment information.
An email address linked to an order or delivery is nevertheless useful to an attacker. It gives a fraudulent message precise context: the customer's name, an expected parcel or a claimed address problem.
Why Shipup increases phishing risk
A delivery-tracking provider operates when customers are already expecting a notification. An attacker can imitate a delayed-parcel text, request an address confirmation or redirect the customer to a fake payment page.
Seeing the Aroma-Zone name or a delivery detail does not prove that a message is legitimate. Check every request through a channel opened manually.
What Aroma-Zone customers should do
Check an order through the Aroma-Zone website or by typing the carrier address yourself. Do not use an SMS or email link to pay a fee, confirm an address or download an attachment.
If the Aroma-Zone password is reused on email, financial accounts or another service, change it on those services first. The Shipup incident does not prove those accounts were compromised, but reuse increases their exposure.
What companies should review in their logistics chain
According to the reported notice, Shipup says it fixed the vulnerability, revoked compromised access, renewed affected credentials and keys, and strengthened its infrastructure security. Aroma-Zone says it activated its data-breach procedure and notified the French data protection authority, CNIL.
LeMagIT and Ostraca report that Shipup was among the organisations affected in the Metabase campaign. Aroma-Zone's notice does not name that software or a CVE, however; this technical link comes from public reporting on the Shipup incident, not from the customer message.
Companies using delivery providers should also map which contact details they share, who can access them, how long they are retained and how incidents are reported. This helps distinguish a supplier breach from compromise of the retailer's own systems.
The link with Soclyde
Soclyde does not protect Shipup, Aroma-Zone or their customers' accounts and cannot undo this breach. Its role is complementary: it helps teams generate a different secret for each service, keep it in a local-first encrypted vault and identify access that needs rotating.
This separation limits the domino effect if a password used for a merchant or logistics service was reused elsewhere.
Key takeaways
The reported incident concerns possible access to customer contact details at Shipup between July 31 and August 17, 2026. Aroma-Zone excludes passwords, orders, delivery data and payments; the cited notice does not confirm extraction of contact details. Verify messages through an official website and read the secure password generator guide or contact Soclyde.
To keep credentials distinct and better control how they are stored, see our guide to local-first password managers.
