# Security Incident Affecting Phrase User Accounts

- Provider: [Phrase](https://down.guide/phrase)
- Level: confirmed
- Impact: Degraded
- lasted 0m
- started 2026-11-06 16:44 UTC
- us
- id: DWN-5c2d479f75
- Official page: https://stspg.io/nqvk5v5dchlp

## Updates from Phrase
### 2026-11-06 16:44 UTC: resolved
Attackers signed in to existing Phrase user accounts with correct usernames and passwords. Once inside, the attackers mainly tried to misuse Phrase’s email notifications to send phishing messages to third parties. The activity came in several waves between late August and October 2026, most likely from more than one group of attackers. Phrase’s own systems were not breached: the attackers signed in with valid usernames and passwords that had been compromised outside of Phrase.

### 2026-11-06 16:45 UTC: postmortem
# Post-Mortem: Security Incident Affecting Phrase User Accounts – Late August–October 2026
## Introduction
We would like to give you a transparent account of a security incident in which unauthorized third parties gained access to Phrase user accounts between late August and October 2026. Phrase's own systems were not breached: the attackers signed in with valid usernames and passwords that had been compromised outside of Phrase. This report explains what happened, what we have done, how our countermeasures affected your daily work, and what you can do to protect your organization.
### What happened
Attackers signed in to existing Phrase user accounts with correct usernames and passwords. In every confirmed case, the first sign-in attempt succeeded: there were no failed attempts beforehand and no two-factor challenge. This shows the credentials had already been obtained elsewhere, through phishing of the user's email or through passwords reused across several services \\("credential stuffing"\\).
Once inside, the attackers mainly tried to misuse Phrase's email notifications to send phishing messages to third parties. They used two features for this:
\* \*\*User invitations\*\*, sent from compromised accounts to large lists of external email addresses.
\* \*\*Custom email templates\*\* in Phrase TMS, where they changed the recipients \\(cc/bcc\\) and inserted links to phishing sites, then triggered notifications at high volume.
In several organizations, the attackers also created additional user accounts or organizations to keep access after a password change. Accessing customer content did not appear to be the attackers' interest; their focus was on sending emails and keeping access. Every affected organization has already been contacted by us.
The activity came in several waves between late August and October 2026, most likely from more than one group of attackers.
### What did not happen
\* We found no evidence that Phrase's own systems or infrastructure were breached. The passwords used were not taken from Phrase. We store passwords only as salted hashes, a one-way form that no-one at Phrase can read or turn back into the password. We can only invalidate a password and trigger a password reset.
\* We found no evidence that the credentials of our email delivery service were leaked. As a precaution, we rotated them anyway.
\* Accounts protected by Single Sign-On \\(SSO\\) or two-factor authentication \\(2FA\\) were not compromised by these methods.
\* In the large majority of affected accounts, the attackers only looked at overview pages, such as project and job lists, before sending emails or being locked out. They did not open, change or download content.
## Timeline
All dates are in 2026.
\* \*\*Late August\*\* – First reports that emails sent through Phrase were being used for phishing.
\* \*\*Early September\*\* – Attackers sent phishing invitations from compromised user accounts.
\* \*\*September 11\*\* – An unrelated alert about a stalled email queue led us to the compromised accounts. We blocked them, closed organizations created by the attackers and notified affected customers.
\* \*\*September 14\*\* – A second wave misused the recipient fields of custom email templates to send phishing emails at high volume. We closed this gap the same night.
\* \*\*September 15\*\* – We enforced a password reset for all users in affected organizations.
\* \*\*September 16–18\*\* – Deeper analysis found further affected organizations. We introduced hourly limits for emails per user and per organization and enabled a filter that blocks phishing-style emails.
\* \*\*September 18–21\*\* – A new wave of credential stuffing. Our new automated intrusion detection caught it. We disabled affected accounts and ended their active sessions.
\* \*\*September 25–27\*\* – Attackers found a new way to insert links into email templates. We switched off the creation and editing of custom email templates by default.
\* \*\*September 29\*\* – No new confirmed intrusions. Previously disabled accounts could be re-enabled on request.
\* \*\*October\*\* – Two-factor enforcement available for all organizations.
## Root Cause
The incident had two causes that together made the attacks possible.
1. \*\*Sign-in with username and password only.\*\* Accounts without SSO or 2FA can be used by anyone who knows the password. Passwords obtained through phishing or reused from other services were enough to sign in.
2. \*\*Email features that could be misused.\*\* Custom email templates and invitations allowed a signed-in user to choose recipients and content freely. Our limits on email volume were set high to support legitimate high-volume customers. This made compromised accounts attractive for sending phishing in Phrase's name.
In addition, our detection relied on indirect signals at first. It took an unrelated operational alert to uncover the first compromised accounts, and our activity logs did not yet hold all the detail needed for a fast investigation.
## Actions to Prevent Recurrence
### What we have done
\*\*Containment\*\*
\* Disabled all compromised accounts, ended their sessions and revoked access tokens created by the attackers.
\* Removed user accounts and organizations the attackers had created.
\* Enforced password resets for all users in affected organizations.
‌
\*\*Closing the attack paths\*\*
\* Limited the number of cc/bcc recipients in email templates and blocked external links in templates by default.
\* Switched off the creation and editing of custom email templates by default. Existing templates keep working; editing is enabled on request.
\* Introduced hourly limits for emails sent per user and per organization, and tighter limits on sign-in attempts.
\* Enabled a filter that blocks phishing-style emails.
\* Prioritized our regular security scanning of the sign-in and translation management applications, resolving many findings with the most critical first.
‌
\*\*Detection and investigation\*\*
\* Introduced automated intrusion detection that watches for the patterns seen in this incident around the clock and raises an alert immediately.
\* Added extended monitoring for unusual email volumes.
\* Extended our activity logging, so we can reconstruct account activity faster and in more detail.
‌
\*\*Stronger sign-in\*\*
\* Organizations can now enforce 2FA for all of their users, in addition to enforcing SSO.
\* We recommend service accounts for integrations and automation, instead of personal usernames and passwords.
\* We have strengthened our central protection against malicious traffic, including stricter rate limits.
\* We now check passwords against lists of weak passwords and passwords exposed in known data breaches elsewhere.
### How our countermeasures affected customers
Several of our protective measures disrupted legitimate work, and we want to be transparent about what happened, why it happened and what we are doing about it.
\* \*\*Password resets\*\* were enforced for whole organizations, not only for the compromised users. We chose this because we could not rule out further compromised accounts that had not been used yet. Some technical users, such as integrations signing in with a personal password, lost access until the password was updated.
\* \*\*Tighter sign-in limits\*\* affected integrations and automated workflows that sign in with a username and password at high frequency. On our side, these look the same as an attack, and this sign-in method was the attack path we had to close.
\* \*\*Email limits and template restrictions\*\* affected customers with high email volumes or templates containing links.
‌
These were emergency changes made under active attack. They were coordinated between our engineering, security and support teams, but not every affected customer was informed in advance. We will notify customers directly and promptly when an emergency security change can affect their workflows, and keep our customer-facing teams informed so they can help.
Planned changes, including changes to sign-in methods and rate limits, are announced in advance.
### What you can do
\* \*\*Enforce SSO or 2FA\*\* for all users in your organization. This is the most effective protection against this type of attack.
\* \*\*Move integrations to service accounts\*\* instead of personal usernames and passwords. Service accounts are not affected by sign-in limits for users.
\* \*\*Use unique passwords.\*\* If a user's Phrase password is also used elsewhere, change it in both places.
\* \*\*Review your users and access tokens.\*\* Look for users, organizations or tokens you do not recognize, especially with owner or admin rights, and remove them.
\* \*\*Be cautious with unexpected emails\*\*, even when they appear to come from Phrase. Verify unusual requests for credentials or payments through a contact you already know.
\* \*\*Report anything suspicious\*\* to our Support team rather than replying to the message.
We take the security of your data and your trust in Phrase seriously, and we apologize for the disruption this incident caused. We continue to monitor our platform closely and will inform you if we learn anything new that affects your organization.
If you have questions, please contact your Customer Success Manager or our Support team.

---
down.guide reads providers' official status pages every minute and adds its own evidence, always labeled. Free, no account. Agents: MCP at https://down.guide/mcp, REST at https://down.guide/api/v1, feeds at https://down.guide/feed. Built by Sazabi (https://sazabi.com/?utm_source=down-guide&utm_medium=markdown).