Service interruption after a security incident at an infrastructure provider
- Started
- Oct 21, 2026 at 22:32 UTC
- Resolved
- Oct 22, 2026 at 12:00 UTC
- Duration
- 13 h 28 min
- Affected
- Sign-in, API and CLI, connic MCP, Agent runs, connic models, Voice, Retrieval and files, Webhooks, WebSockets, Kafka, SQS and PostgreSQL, Email, Schedules, Bridge
Postmortem
Summary
On October 21, one of our infrastructure providers disclosed a security incident affecting the systems where it stores service credentials. connic runs part of its platform on this provider. As a precaution, we took the platform offline on October 21 at 23:47 UTC, replaced our service credentials and reviewed our systems for unauthorized access. The platform was available again on October 22 at about 09:50 UTC.
We found no evidence that customer data was accessed or decrypted.
Impact
Between October 21, 23:47 UTC and October 22, about 09:50 UTC, the dashboard, sign-in, the API and CLI, connic MCP, connic models and all agent triggers were unavailable.
Triggers that arrived during this time were not processed. Sources that retry or keep messages queued delivered them after recovery. Others may need to be sent again.
Timeline (UTC)
| Time | Event |
|---|---|
| Oct 21, 21:59 | The provider publishes its security disclosure. |
| Oct 21, 22:32 | We open this incident and start assessing our exposure. |
| Oct 21, 23:47 | We take the platform offline as a precaution. |
| Oct 22, overnight | We revoke and replace service credentials and review access logs. |
| Oct 22, about 09:50 | The platform is back online with new credentials. |
| Oct 22, 12:00 | Verification is complete and the incident is resolved. |
What we found
We reviewed the network logs of our databases, the logs of our sign-in and model services, and the audit logs of our cloud accounts back to October 14. We found no sign of unauthorized access to customer data, our databases or our sign-in system, and no unauthorized use of our cloud accounts.
What changes for you
- You may need to sign in again.
- Reconnect your MCP clients.
- Your deployed agents were redeployed with new credentials. No action is needed.
We are sorry for the interruption. Security is our top priority, and we chose to stay offline until all credentials had been replaced.
Updates
-
ResolvedOct 22, 2026 at 12:00 UTC
On October 21, one of our infrastructure providers disclosed a security incident affecting the systems where it stores service credentials. As a precaution, we took parts of the connic platform offline and replaced our service credentials.
We reviewed the available access logs across our infrastructure and found no evidence that customer data was accessed or decrypted.
connic is fully available again. Because credentials were replaced, you may need to sign in again and reconnect your MCP clients.
We are sorry for the interruption. Security is our top priority, and we chose to stay offline until all credentials had been replaced.
-
InvestigatingOct 21, 2026 at 22:32 UTC
One of our infrastructure providers is investigating a security incident on its platform. We are assessing whether connic is affected and have taken precautionary security measures in the meantime.
connic is currently available. Some features may be briefly interrupted while these measures are in place.
We will update this page as soon as we know more.