Abnormal Security outage history

Beginning at 14:35 UTC on October 8, 2026, Abnormal began investigating an issue affecting some Educational related customers using Google Workspace hosted in the US and EU. During this time, some inbound emails for .EDU mailboxes may not be evaluated in real time, which may temporarily reduce email detection coverage for affected mailboxes. Abnormal is actively working to restore normal processing and will provide an update as more information becomes available.

Abnormal continues to work with Google Support to mitigate the issue while simultaneously implementing a short-term solution to restore normal email processing for affected customers. Additional updates will be provided as more information becomes available.

As of 21:10 UTC on October 8, 2026, the service disruption affecting Inbound Email Security detection and remediation for some hosted US and EU educational customers has been resolved. Email processing for affected mailboxes has returned to normal, and services have remained healthy for the past 30 minutes. All impacted messages from the incident window will be reprocessed to ensure complete email security.

Starting at approximately 23:30 UTC on September 30, 2026, Abnormal began experiencing a service disruption affecting Inbound Email Security detection and remediation for some hosted US customers. Inline email may also not be detected or remediated as expected during this time. Abnormal engineers are actively working to restore services, and the next update will be provided within one hour or sooner if additional information becomes available.

Abnormal engineers have identified the issue and are actively working on a fix to restore full service. The next update will be provided within one hour or sooner if additional information becomes available.

Email detection and remediation services for hosted US customers were fully restored at 02:15 UTC on October 1, 2026. Abnormal engineers are processing messages that failed to process during the incident window, which is expected to complete by approximately 03:15 UTC on October 1, 2026. Please contact Abnormal Support at [email protected] if further issues occur.

Starting around 17:50 UTC, Abnormal began experiencing a service disruption affecting Portal access for Government customers. During this time, impacted customers may be unable to access the Portal. Email detection, scoring, and remediation services remain fully operational, and customer security protection is not impacted. Abnormal's engineering team is actively investigating and working to restore full functionality. Abnormal will provide the next update within 60 minutes or sooner as more information becomes available. If you experience any further issues, please reach out to Abnormal's support team at [email protected].

As of 18:57 UTC, Abnormal has restored services and confirmed that Portal access has been restored for Government customers. The service disruption that began around 17:50 UTC has been fully resolved, and all Portal functionality is now operating normally. Email detection, scoring, and remediation services remained fully operational throughout, and customer security protection was not impacted. If you experience any further issues, please reach out to Abnormal's support team at [email protected].

Starting at 16:50 UTC, Abnormal began experiencing a service disruption affecting email scoring, detection, and remediation for GOV customers. During this time, GOV customers may experience emails not being analyzed or remediated during this time. The engineering team is actively investigating and working to restore full functionality. The next update will be provided within 1 hour or sooner as more information becomes available. If you experience any further issues, please reach out to Abnormal's support team at [email protected].

Beginning around 16:50 UTC, Abnormal experienced delays in Email Scoring for customers in the United States Government region, where some messages took longer than usual to be scored. Abnormal identified the cause, applied a fix, and has fully restored normal scoring performance as of the resolution time. Detection and remediation of email threats continued to operate as expected throughout this period. All messages from the impacted window will be replayed and scored, so no messages will be missed. If you experience any further issues, please reach out to Abnormal's support team at [email protected].

Starting at 08:50 UTC, Abnormal began experiencing a service disruption affecting AI Security Mailbox notifications for US and EU customers. The AI Security Mailbox continues to function as expected, and customer security protection is not impacted.  However, affected customers are not currently receiving notifications. Abnormal is actively working with our email delivery provider to restore notification delivery for customers.

Starting at 08:50 UTC, Abnormal experienced a service disruption affecting AI Security Mailbox notifications for US and EU customers. Throughout the incident, the AI Security Mailbox continued to function as expected and customer security protection was not impacted; however, affected customers did not receive notifications during the incident window. Abnormal worked with its email delivery provider to reinstate the account, and AI Security Mailbox notifications are now being sent as expected. All notifications from the incident window will be processed. If you experience any further issues, please reach out to Abnormal Support at [email protected].

Starting at 13:15 UTC, Abnormal experienced a service disruption affecting Inbound Email Security and Inline detection and remediation for US customers, resulting in elevated processing time. During this window, some messages experienced delayed detection and remediation. Engineers restored the live processing queue and inline remediation error rates recovered as of 14:18 UTC.

Starting at 17:00 UTC on August 3, 2026, Abnormal began experiencing an issue with Account Takeover case details for Gov customers. Customers may experience issues loading Account Takeover case details within the portal. Account Takeover detection and alerting remain fully operational. The engineering team is actively investigating and working to restore full functionality. The next update will be provided in 1 hour or when further information is obtained.

The engineering team has identified the issue and is actively working to deploy a fix. Account Takeover detection and alerting remain fully operational. The next update will be provided when further information is obtained.

The engineering team continues to work toward a resolution. Timeline data within Account Takeover cases is now loading as expected; however, case details and entity statistics remain unavailable. A fix is currently being deployed. The next update will be provided when further information is obtained.

The engineering team has resolved the primary issue affecting Account Takeover case details in the Gov region. Case details and timeline data are now loading as expected. The remaining minor issues will be addressed separately. Abnormal considers this incident resolved. If you have any further questions, please reach out to support at [email protected].

Between 22:10 UTC and 22:50 UTC on July 27, 2026, Abnormal experienced a service disruption affecting Inbound Email Security, Inline, and Graymail processing for Google Workspace customers in both US and EU regions. During this time, inbound email processing was temporarily interrupted, which may have caused delays in email detection and remediation. The engineering team has resolved the issue, and all services have been fully restored. All emails from the impacted window have been successfully reprocessed. If you experience any further issues, please reach out to the support team at [email protected].

Starting at 22:00 UTC on July 7, 2026, Abnormal began experiencing a service disruption impacting Inbound Email Security detection and email remediation for US customers. During this time, inline customers may have emails delivered without security scoring or remediation, and Inbound Email Security detection is degraded. Additionally, AI Security Mailbox is experiencing issues within the portal which the Abnormal team is actively investigating. Our team is working to restore full functionality. The next update will be provided within 1 hour or sooner as more information becomes available.

Abnormal continues to experience a service disruption impacting Inbound Email Security detection and email remediation for US tenant customers that began at 22:00 UTC on July 7, 2026. During this time, emails may be delivered without full security analysis, and some customers may be unable to login to the Abnormal Portal. The Abnormal engineering team continues to actively work on restoring full functionality. The next update will be provided within 1 hour or sooner as more information becomes available.

As of 00:23 UTC on July 8, 2026, AI Security Mailbox and Portal services have been fully restored for US tenant customers. The Abnormal engineering team is currently deploying a mitigation for Inbound Email Security services, which are expected to be fully restored within the next 30 minutes. During this time, some emails may still be delivered without full security analysis. The next update will be provided once Inbound Email Security services are confirmed restored.

The Abnormal engineering team continues to work on restoring full Inbound Email Security services for US tenant customers. During this time, some emails may still be delivered without full security analysis. Additionally, Abnormal has identified that this issue is beginning to impact EU tenant customers, which the engineering team is actively addressing. The next update will be provided within 60 minutes or sooner as more information becomes available.

Abnormal has begun to see early signs of recovery for Inbound Email Security services impacting US and EU tenant customers. The Abnormal engineering team continues to monitor for full recovery. During this time, some emails may still experience delayed security analysis. The next update will be provided once full recovery is confirmed.

As of 04:44 UTC on July 8, 2026, all services have fully recovered and are now live processing traffic for US and EU tenant customers. Abnormal will reprocess all messages received during the impact window to ensure full security analysis is applied. If you experience any continued issues, please reach out to the support team at [email protected].

Between 16:45 UTC and 17:25 UTC on June 5, 2026, Abnormal experienced message remediation delays affecting Inbound Email Security for GOV customers. During this time, some emails may have experienced delayed remediation. The Abnormal engineering team actively worked to address the issue, and service was fully restored as of 17:25 UTC. All emails from the impacted window have since been reprocessed. If you experience any further issues, please reach out to our support team at [email protected].

Between 20:00 UTC and 21:22 UTC on June 4, 2026, Abnormal experienced a service disruption impacting inbound email ingestion for all inline US customers. During this time, inbound emails sent to customers may not have been ingested or processed. The Abnormal engineering team identified and resolved the root cause, and service was confirmed recovering as of 21:22 UTC. Emails affected during the incident window have been reprocessed. If you experience any further issues, please reach out to our support team at [email protected].

Starting at 17:45 UTC on June 2, 2026, Abnormal began experiencing a service disruption affecting email scoring, detection, and remediation for Inbound Email Security in the EU region. EU customers may experience emails not being analyzed or remediated during this time. The engineering team is actively investigating and working to restore full functionality. The next update will be provided within 1 hour or sooner as more information becomes available.

Starting at 17:45 UTC on June 2, 2026, Abnormal experienced a service disruption affecting email detection and remediation for Inbound Email Security customers in the EU region. Additionally, between 18:00 UTC and 19:00 UTC, US customers experienced degraded attack detection and AI Security Mailbox functionality. Abnormal is now beginning to see recovery across impacted services. The engineering team continues to monitor as systems restore to full operational capacity. Any emails from the impacted window will be reprocessed. A further update will be provided once full recovery is confirmed.

Starting at 17:45 UTC on June 2, 2026, Abnormal experienced a service disruption affecting email detection and remediation for Inbound Email Security customers in the EU region. Additionally, between 18:00 UTC and 19:00 UTC, US customers experienced degraded AI Security Mailbox functionality. As of 19:20 UTC, all services have been restored and live traffic is processing normally across both regions. Abnormal is continuing to work through retry queues to reprocess any emails from the impacted window. If you experience any further issues, please reach out to our support team at [email protected].

Starting at 04:27 UTC on May 29, 2026, Microsoft is experiencing degraded delivery of M365 sign-in audit logs due to an issue on Microsoft's infrastructure. As a result, customers using Account Takeover detection with Microsoft M365 may see a delay of up to 90 minutes in the creation of detection cases based on sign-in activity. No sign-in data is being lost, and Abnormal has adjusted processing to account for the delay and ensure no detections are missed. All other Account Takeover data sources continue to operate at full capacity. Abnormal is actively monitoring the situation and will provide updates as it evolves. If you have any questions, please reach out to Abnormal support at [email protected].

We are continuing to investigate this issue.

Microsoft has confirmed that the degraded delivery of M365 sign-in audit logs was caused by a power event in their West US 2 datacenter, which began at 04:27 UTC on May 29, 2026. Microsoft has reported that their service is on a recovery path and is currently processing the accumulated backlog, including sign-in stream data. As a result, customers using Account Takeover detection with Microsoft M365 may continue to experience delays in the creation of detection cases based on sign-in activity until the backlog is fully consumed. No sign-in data has been lost, and Abnormal has adjusted processing to account for the delay and ensure no detections are missed. All other Account Takeover data sources continue to operate at full capacity. Abnormal will continue to monitor and provide a further update once Microsoft confirms full recovery. If you have any questions, please reach out to Abnormal support at [email protected].

Microsoft has confirmed the root cause of the degraded M365 sign-in audit log delivery has been fixed and services are currently recovering. Microsoft estimates full recovery within approximately 7 hours. Once Microsoft services complete recovery, Abnormal expects Account Takeover detection to begin processing normally and will work through the backlog of sign-in events from this incident. No data has been lost. Abnormal will post a final resolved update once Microsoft confirms full restoration and backlog processing is complete.

Microsoft services have fully recovered from the degraded M365 sign-in audit log delivery, and Abnormal services have also recovered as of 09:41 UTC on May 30, 2026. Abnormal engineering has initiated a reprocess to ensure all Account Takeover detections from the impacted time window are properly processed. No sign-in data was lost during this event. If you experience any further issues, please reach out to Abnormal support at [email protected].

Starting at 22:00 UTC on May 18, 2026, Abnormal identified an increase in legitimate emails being incorrectly flagged as malicious and remediated, impacting Inbound Email Security and AI Security Mailbox. The engineering team identified and disabled the rule responsible for falsely flagging these emails at 01:03 UTC on May 19, 2026. Messages affected during the impact window will be reprocessed.

Between 00:19 UTC and 00:49 UTC, Abnormal experienced message remediation delays affecting Inbound Email Security for US customers. During this approximately 30-minute window, email remediation was temporarily delayed due to a backend database issue. The engineering team stopped the contributing process and remediation services recovered. All messages from the impacted window have since been reprocessed. If you experience any further issues, please reach out to our support team at [email protected]

Abnormal is currently investigating an issue affecting Security Orchestration, Automation and Response (SOAR) API functionality for US customers. Customers utilizing SOAR API integrations may experience errors when attempting to query messages, attachments, and threat data. Some Portal functionality that relies on the same data source may also be intermittently affected. The Abnormal engineering team is actively investigating the root cause and working toward resolution. Email detection and remediation services remain fully operational and are not affected by this incident.

Between approximately May 2, 2026, and May 4, 2026 at 18:45 UTC, Abnormal experienced a service disruption affecting Security Orchestration, Automation and Response (SOAR) API functionality, Portal data retrieval, and Threat Log display for US customers. During this time, customers utilizing SOAR API integrations may have experienced errors when attempting to query messages, attachments, and threat data. The Abnormal engineering team has deployed a fix and confirmed that SOAR API is functioning as expected. All affected services have been restored to normal operation. If you experience any further issues, please reach out to the Abnormal support team at [email protected].

Starting at 00:30 UTC on April 28, 2026, Abnormal identified an issue impacting email detection accuracy, which may result in some legitimate emails being incorrectly flagged. Abnormal engineering is actively investigating and implementing corrective measures to restore full detection accuracy. Email remediation services remain operational. Abnormal will provide an update within 1 hour or as new information becomes available.

Abnormal engineering has identified the root cause and is working to implement a fix to fully restore email protection. Abnormal will provide an additional update within 1 hour or as new information becomes available.

Between 00:30 UTC and 08:10 UTC on April 28, 2026, Abnormal experienced an issue impacting email detection and scoring accuracy, which may have resulted in some legitimate emails being incorrectly flagged. Abnormal engineering identified the root cause, implemented a fix, and confirmed that all email detection and scoring services have been fully restored. All messages received during the impact window will be replayed to ensure complete email protection coverage. If you experience any further issues, please reach out to the support team at [email protected].

Starting at approximately 19:00 UTC on April 8, 2026, Abnormal began receiving reports of customers being unable to access the Customer Support Portal. Some customers may experience intermittent or complete inaccessibility when attempting to log in or navigate the Customer Support Portal. The Abnormal engineering team is actively investigating the underlying cause of the issue.

Starting at approximately 19:00 UTC on April 8, 2026, Abnormal received reports of customers being unable to access the Customer Support Portal. Some customers experienced intermittent or complete inaccessibility when attempting to log in or navigate the Portal. The Abnormal engineering team identified and resolved the underlying cause. As of 16:40 UTC on April 9, 2026, Customer Support Portal access has been fully restored and customers are able to successfully log in.

Starting at 13:30 UTC on April 8, 2026, Abnormal began experiencing an issue with receipt of email-based support case submissions and replies due to a vendor caused issue. Customer emails to [email protected] or [email protected] may be delayed. Abnormal support is actively monitoring the issue and will provide further updates once additional information is received from the vendor. In the meantime, customers are encouraged to submit support inquiries through the Abnormal Customer Support Portal at https://abnormalsecurity.my.site.com/support/s/.

Starting at 13:30 UTC on April 8, 2026, Abnormal experienced an issue with the email-based support case submission process due to a vendor-caused outage. Customers who submitted support requests by emailing [email protected] or [email protected] may have experienced failures when attempting to create new cases. The vendor has confirmed that service has been restored, and Abnormal has verified that emails are now flowing as expected. Customers may resume submitting support requests via email.

Between 09:53 UTC on April 4, 2026 and 17:38 UTC on April 6, 2026, Abnormal experienced an issue within the Gov Portal affecting the AI Security Mailbox Analyzed tab and remediation information cards on the message details page. During this time, Gov customers may have experienced failures when loading the AI Security Mailbox Analyzed tab, and remediation details may have appeared incomplete or failed to display on the message details page. The Abnormal engineering team identified and resolved the underlying issue, and full functionality has been restored. If you experience any further issues, please reach out to the support team at [email protected].