# Notice of a data breach affecting your Tally account

Canonical: https://brew.new/browse/templates/email/pt1_k97nz3bxzbh34xzf4j9az6k3ms8e3zyj

Brand: tally.so
Category: newsletter

![Preview of Notice of a data breach affecting your Tally account](https://cdn.brew.new/email-preview-9e59951b28973673-tracking_r57gjb8w2r8wnkr8m5dtdy9h558dtk44-1788998049286.png)

## Email content

Dear John,

On August 3, an attacker gained unauthorized access to Metabase, the analytics service we use to see how Tally is used. Through that they reached your email address, and your password as a cryptographic hash. A hash is one-way, so it can't be turned back into your password. They didn't reach your forms, or the answers people submitted to them. Those are stored separately.

We know exactly what was and wasn't accessed because Metabase sent us their logs, and we checked them against our own database logs. They used a flaw in Metabase's software that nobody knew about, not even Metabase. Metabase told us on August 6, and we shut the access down the same day. They never got into Tally's own systems, only into Metabase.

What we've done

We changed our internal keys and passwords, just to be safe. Metabase can't reach our database any more. Metabase has patched the flaw and brought in an outside security firm. We've reported this to the Belgian Data Protection Authority.

We also checked our sign-in records for those days, and found no sign that anyone used the leaked data to get into an account.

What this means for you

The main risk is phishing. Because they have your email address, you may get emails that look like they came from Tally but didn't. We'll never email you a link to reset your password because of this. If you get one, it isn't from us.

Don't type your Tally password into a page you reached from a link in an email. Type tally.so into your browser yourself and sign in there.

What we suggest

No action is required, though changing your password and enabling two-factor authentication are good habits.

Questions

Metabase's own investigation is still going. If we learn anything that changes what we've told you here, I'll email you again.

I'm sorry we put you in this position. If you've got questions, just reply to this email and it comes straight to me.

Filip Minev

Co-founder @ Tally

Tally, the simplest way to create forms. Made and hosted in the EU 🇪🇺

Unsubscribe · Help center · Roadmap · What's new · Feature requests

[Open and remix this design](https://brew.new/browse/templates/email/pt1_k97nz3bxzbh34xzf4j9az6k3ms8e3zyj)

[Browse email designs](https://brew.new/browse/templates)