Major incident

RSA ID Plus: RSA ID Plus Service Incident (EMEA Region)

Current status of RSA ID Plus: Operational — live RSA ID Plus status

Timeline

1. Sep 14, 2026, 06:30 UTC
   resolved
   We experienced a service degradation affecting a subset of customers hosted in our EMEA region on the EU Pod 2 deployment. Some customers may have experienced intermittent issues accessing the service. This issue is no longer ongoing. We will post a root cause analysis as soon as it is available.
2. Sep 17, 2026, 01:35 UTC
   postmortem
   **Root Cause Analysis** On September 14, 2026, from approximately 06:35 UTC until 08:00 UTC, some customers hosted in the RSA ID Plus EU2 environment experienced degraded authentication service. During this period, some authentication requests were delayed or failed to complete. Impact varied by customer and authentication flow. The service recovered without intervention as morning traffic levels settled. **What Happened** As authentication activity increased, a flaw in the service’s work-distribution algorithm repeatedly reassigned work among service components. Each reassignment added activity elsewhere and prompted further reassignment, creating a cycle that degraded authentication processing. Some user provisioning and directory-related requests were also affected. **Root Cause** The root cause was a defect in the algorithm the service uses to distribute work. Under changing processing conditions, the algorithm did not keep work assignments stable; instead, it repeatedly reassigned work and amplified activity across the environment. This cascading behavior—not increased activity alone—caused the authentication delays and failures. **Resolution** Service performance recovered as activity decreased and the environment stabilized. Engineering confirmed that latency and error rates had returned to normal levels and continued monitoring the service. No customer action or configuration changes are required. **Why Disaster Recovery Was Not Activated** The EU2 environment remained partially operational and did not meet the criteria for regional failover. Because the issue involved how work was distributed within the service, moving traffic to the recovery region was not expected to resolve it and could have introduced additional disruption while the service was stabilizing. **Corrective Actions** RSA is pursuing the following improvements to reduce the likelihood and impact of similar events: * **Tenant-work routing:** Changes to how work is redistributed within the authentication service tier under load, to prevent repeated redistribution cycles. * **Runtime behavior:** Analysis of memory management telemetry to determine whether further tuning is warranted. * **Detection:** Improved monitoring and alerting so this pattern is identified earlier.

Updates as published by RSA ID Plus (original).