# Security Notice: Unauthorized Access via Third-Party Analytics Tool

- Provider: [Checkly](https://down.guide/checkly)
- Level: confirmed
- Impact: Degraded
- lasted 0m
- started 2026-08-10 18:42 UTC
- id: DWN-2a35b40121
- Official page: https://is.checkly.online/incident/ee0aa53a-f199-4cd8-a8a6-1de1df9750e6

## Updates from Checkly
### 2026-08-10 18:42 UTC: resolved
Status: Resolved
 On 3 August 2026, an attacker exploited a zero-day vulnerability in Metabase, a third-party analytics tool we use internally, and gained read-only access for approximately 26 minutes to a data warehouse holding a copy of Checkly operational data. Our production platform, including check execution and alerting, was not accessed, and Checkly secrets remained encrypted. Values stored directly in check configurations (custom headers, cookies, query parameters, authorization headers) and hashed OTEL API keys should be considered exposed. We recommend rotating any affected credentials. Metabase has patched the vulnerability and we have investigated the impact.
 Full details and remediation steps are available in our blog post: https://checklyhq.com/blog/metabase-security-incident

---
down.guide reads providers' official status pages every minute and adds its own evidence, always labeled. Free, no account. Agents: MCP at https://down.guide/mcp, REST at https://down.guide/api/v1, feeds at https://down.guide/feed. Built by Sazabi (https://sazabi.com/?utm_source=down-guide&utm_medium=markdown).