Security Advisory: Unauthorized Access via Credential Stuffing

What to do

• Check whether your product depends on Pantheon. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 1d 6h it lasted.

  Anything that failed between 2026-04-15 14:27 UTC and 2026-04-16 20:30 UTC may need a replay.

• Subscribe to Pantheon's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=pantheon works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Pantheon 2

1. investigatingApr 15, 2026, 2:27 PM UTC

   We are currently investigating reports of unauthorized access to a small number of Pantheon customer accounts. Our evidence suggests these accounts were accessed using credentials stolen from external third-party data breaches (unrelated to Pantheon). This technique, known as "credential stuffing," relies on reused passwords. Required Actions for All Customers • Audit Your Sites: Check for unexpected code or file modifications. If you find any suspicious changes, contact Pantheon Support immediately. • Enable MFA (High Priority): Multi-factor authentication is your best defense against password theft. • Enable MFA here: https://docs.pantheon.io/guides/account-mgmt/account/mfa • Update Your Password: If you use your Pantheon password on any other site, change it immediately to a unique, strong passphrase. Next Steps: We are continuing our investigation and will provide further updates as more information becomes available.

   provider

2. resolvedApr 16, 2026, 8:30 PM UTC

   Final Update: We have concluded our investigation into the reports of unauthorized account access. Our team has worked directly with the small number of affected customers to secure their accounts and remediate any unauthorized changes. Monitoring & Conclusion: We have seen no further evidence of unauthorized activity related to this incident. Our systems remain secure, and we continue to monitor for suspicious login patterns. Ongoing Security Best Practices: While this incident is resolved, credential stuffing remains a common web-wide threat. To keep your account secure, we strongly recommend: • Enabling MFA on all Pantheon user accounts. • Using unique passwords managed via a password manager. • Rotating secrets/keys if you suspect your local environment has been compromised. Thank you for your patience as we worked to keep the Pantheon community secure.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.