Minor incident

Phrase: Security Incident Affecting Phrase User Accounts

Current status of Phrase: Operational — live Phrase status

Timeline

1. Nov 6, 2026, 16:44 UTC
   resolved
   Attackers signed in to existing Phrase user accounts with correct usernames and passwords. Once inside, the attackers mainly tried to misuse Phrase’s email notifications to send phishing messages to third parties. The activity came in several waves between late August and October 2026, most likely from more than one group of attackers. Phrase’s own systems were not breached: the attackers signed in with valid usernames and passwords that had been compromised outside of Phrase.
2. Nov 6, 2026, 16:45 UTC
   postmortem
   # Post-Mortem: Security Incident Affecting Phrase User Accounts – Late August–October 2026 ## Introduction We would like to give you a transparent account of a security incident in which unauthorized third parties gained access to Phrase user accounts between late August and October 2026. Phrase's own systems were not breached: the attackers signed in with valid usernames and passwords that had been compromised outside of Phrase. This report explains what happened, what we have done, how our countermeasures affected your daily work, and what you can do to protect your organization. ### What happened Attackers signed in to existing Phrase user accounts with correct usernames and passwords. In every confirmed case, the first sign-in attempt succeeded: there were no failed attempts beforehand and no two-factor challenge. This shows the credentials had already been obtained elsewhere, through phishing of the user's email or through passwords reused across several services \("credential stuffing"\). Once inside, the attackers mainly tried to misuse Phrase's email notifications to send phishing messages to third parties. They used two features for this: * **User invitations**, sent from compromised accounts to large lists of external email addresses. * **Custom email templates** in Phrase TMS, where they changed the recipients \(cc/bcc\) and inserted links to phishing sites, then triggered notifications at high volume. In several organizations, the attackers also created additional user accounts or organizations to keep access after a password change. Accessing customer content did not appear to be the attackers' interest; their focus was on sending emails and keeping access. Every affected organization has already been contacted by us. The activity came in several waves between late August and October 2026, most likely from more than one group of attackers. ### What did not happen * We found no evidence that Phrase's own systems or infrastructure were breached. The passwords used were not taken from Phrase. We store passwords only as salted hashes, a one-way form that no-one at Phrase can read or turn back into the password. We can only invalidate a password and trigger a password reset. * We found no evidence that the credentials of our email delivery service were leaked. As a precaution, we rotated them anyway. * Accounts protected by Single Sign-On \(SSO\) or two-factor authentication \(2FA\) were not compromised by these methods. * In the large majority of affected accounts, the attackers only looked at overview pages, such as project and job lists, before sending emails or being locked out. They did not open, change or download content. ## Timeline All dates are in 2026. * **Late August** – First reports that emails sent through Phrase were being used for phishing. * **Early September** – Attackers sent phishing invitations from compromised user accounts. * **September 11** – An unrelated alert about a stalled email queue led us to the compromised accounts. We blocked them, closed organizations created by the attackers and notified affected customers. * **September 14** – A second wave misused the recipient fields of custom email templates to send phishing emails at high volume. We closed this gap the same night. * **September 15** – We enforced a password reset for all users in affected organizations. * **September 16–18** – Deeper analysis found further affected organizations. We introduced hourly limits for emails per user and per organization and enabled a filter that blocks phishing-style emails. * **September 18–21** – A new wave of credential stuffing. Our new automated intrusion detection caught it. We disabled affected accounts and ended their active sessions. * **September 25–27** – Attackers found a new way to insert links into email templates. We switched off the creation and editing of custom email templates by default. * **September 29** – No new confirmed intrusions. Previously disabled accounts cou

Updates as published by Phrase (original).