No components marked as affected
Monitoring
A fix is now live. The APIs involved no longer return data from other organizations. We are reviewing the attack vector and continuing our investigation. Affected customers have been notified with steps for rotating the credentials involved.
Investigating
We are investigating unauthorized access to customer data. The activity occurred on November 2, 2026, between about 7:50 PM and 8:40 PM PT. An unauthorized party is attempting to reach data belonging to a limited number of customer organizations, including stored integration credentials and uploaded documents. The activity is blocked, and the accounts involved are disabled. We are deploying a fix and working to confirm the full scope. Platform availability is not affected.