Support / SUP-1142
Vossberg: written statement on the attack for our security team
Description
Our security team asks for a short written statement about last night's attack, for their records: what happened, whether Vossberg is affected, what you change.
Linked issues
- relates to OPS-41 Credential stuffing against password sign-in in the EU: about 1.9 million attempts Done
Comments (3)
Matthias Krüger · 4 Sep 2026, 07:15 UTC
Thank you, that is what they needed.
Mira Holm · 10 Sep 2026, 09:00 UTC
Lockout and limits went live this morning; details are in today's release note.
Hi Matthias, here's a statement you can pass on:
What happened. On the night of Wednesday 2 September, from just before midnight into the early hours (CEST), an automated attack tried email and password pairs stolen from other services against ACME's password sign-in, at several customers. No attempt from the attacking addresses signed in.
Vossberg. Your people sign in through Okta and have no ACME password, so the attack didn't reach them. Your three administrators' fallback accounts still have ACME passwords; none of them was tried.
What we're changing. Account lockout after repeated failed passwords, and limits on attempts from one internet address, live next week. We'll confirm when they're in place.
Mira Holm, Security and platform lead