On 9 June 2026, millions of Crédit Agricole customers received a push notification reading “Test Cédric” in their Ma Banque app. 27 million recipients, an app that buckled under the load of simultaneous logins, and a viral story within minutes. The bank handled the incident with real creativity by renaming itself “Cédric Agricole” on social media, turning the slip-up into a brand moment. But the incident itself was not unavoidable.
This is not the first time. In 2022, Air France sent a test email titled “Test de Julien” to thousands of customers. Two incidents, two different companies, the same underlying problem: no guardrails between the test environment and production.
A message sent to your production database by mistake is not only a technical problem. It is a matter of customer trust, of sender reputation, and sometimes a GDPR issue if the test data contains real personal information.
In CRM and marketing automation, production is your real customer database. One misconfigured workflow, one badly set target, and you are sending a test email to 2 million active contacts, or worse, mass quarantining real addresses.
As pointed out in the QA guide from Mr Suricate (January 2026), the key is to have “stable test data and a production-like environment to avoid false positives”. The test environment has to look like production in configuration, volume and behavior, without ever being connected to real customer data.
And as Invox puts it in its Marketing Automation guide : “poorly organized data is without doubt one of the worst things that can happen to your business.” Data quality starts with keeping environments properly separated.
Adobe Campaign Classic has several native mechanisms to protect production:
I went into why this separation matters in my article on technical workflow vs. campaign workflow: a badly categorized workflow can trigger sends without applying typologies, and therefore without the guardrails you expected.
On Salesforce, environment management is structured around sandboxes:
I went through the Salesforce deployment risks in my article on Change Sets, SFDX and best practices : the DEV → Full Sandbox → Production chain is not optional.
QA in CRM is not only about checking that the workflow runs without errors. It covers:
One simple rule I apply on every project: the person who built the delivery cannot approve and send it themselves. A second pair of eyes, always. That is the rule Cédric did not have.
The Crédit Agricole incident is not the fault of a distracted developer. It is the symptom of a process that never planned for this scenario. In an organization of that size, with 27 million users, sending a push notification should require several levels of validation. If a single person can trigger a send to the entire database from a test environment, the problem is not technical, it is organizational.
As I described in my article on the projects that fail their UAT : production incidents almost never come from the code. They come from the absence of process around the code.
The most expensive technical debt is not the one you have piled up. It is the one you never planned to put in production.
Test / production separation and approval workflows are among the points I check every time. Free scoping call, no commitment.
Contact →