Operations / OPS-41
Credential stuffing against password sign-in in the EU: about 1.9 million attempts
Description
Summary
On the night of Wednesday 2 September, from 23.40 to 02.40 CEST, someone ran lists of email addresses and passwords stolen from other services against our password sign-in in the EU region: about 1.9 million attempts from about 11,000 IP addresses. No attempt from the attacking addresses signed in. Summary for customers: Confluence OPS › OPS-41: credential stuffing against password sign-in.
Incident lead: Oskar Lund. Security: Mira Holm.
Impact
- About 6,100 attempts used an email address that exists at one of our clients, at nine clients. The rest were addresses we don't know.
- Every successful sign-in in the EU region that night was checked against the attacking addresses: none.
- 212 people saw more than 20 wrong passwords. Their administrators were told which people, with a suggestion to change the password.
- Password sign-in was slow for about three hours. Our first block on whole networks also refused 11 night-shift sign-ins at Northgate's Warrington site from 00.20 to 00.41.
- Single sign-on depots and phone codes were not touched. Administrators have needed MFA since 11 June.
Timeline (CEST)
- 23.40 Failed sign-in alarm in the EU region. Oskar paged.
- 23.52 Oskar sees the pattern: many addresses, few tries each, real-looking emails.
- 00.05 Status page: password sign-in slow in the EU.
- 00.20 Temporary WAF rule blocks the worst networks. Northgate's night-shift sign-ins caught by it.
- 00.41 Rule narrowed; Northgate's sign-ins work.
- 00.45 Tighter rate rule per address on the sign-in endpoints.
- 02.40 Attempts stop.
- 02.55 Status page resolved.
- 07.30 Mira and Rafael read the timeline; customers to be told by noon.
- 11.50 Support writes to the nine clients' administrators.
Why it could happen
A loose limit per address and no limit per account. Nothing stopped thousands of addresses trying a few passwords each.
Follow-ups
- Edge rate limits and bad-address lists: OPS-42
- Lockout per account: ENG-1705; the urgent initiative: ENG-1702
- Runbook: Confluence ENG › Runbook: credential stuffing and lockouts
Linked issues
- relates to ENG-1702 Sign-in lockout and rate limits Done
- relates to OPS-42 Edge rate limits on the sign-in endpoints, and managed bad-address lists Done
- relates to SUP-1139 Northgate: Warrington night shift couldn't sign in for 20 minutes Done
- relates to SUP-1143 Marlow: were any of our accounts used in the attack? Done
- relates to SUP-1145 Northgate: list of our people whose emails were tried Done
- relates to SUP-1146 Kelderby: were our accounts part of the attack? Done
- relates to SUP-1140 Greenhollow: failed sign-ins overnight in our log, were we affected? Done
- relates to SUP-1141 Brakeline: anything to do after last night? Done
- relates to SUP-1142 Vossberg: written statement on the attack for our security team Done
- relates to ENG-1708 Refuse known-breached passwords when a password is set or reset Backlog
Comments (2)
Oskar Lund · 16 Sep 2026, 14:30 UTC
Review done in Emargen with Mira, Rafael, Ines and Lukas. Counted as the incident response rehearsal for September.
Closing the incident; the work continues in ENG-1702 and OPS-42. Customers' questions are on SUP-1139 to SUP-1146; Northgate (SUP-1145) get the list of their people whose emails were tried, nothing more.