Maropost outage history

We are investigating platform instability affecting Neto webstores. Customers may experience intermittent issues accessing affected stores. Our team is working to restore stability. We will provide further updates as more information becomes available.

Services are currently stable. We are continuing to monitor performance and investigate the cause of the disruption.

This incident has been resolved.

We are receiving reports of control panels receiving "Software error". Our Development Team are investigating now.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

Some Neto merchants and partners are experiencing SFTP access issues. Our team is actively investigating and working to implement a fix. We will provide further updates as progress is made.

The issue has been identified and a fix is being implemented.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

Some Neto merchants are experiencing issues accessing their Control Panels. Our team is actively investigating the issue and will provide further updates as more information becomes available.

The issue has been identified and a fix is being implemented.

We are implementing fixes for the Control Panel access issues. We will provide further updates as progress is made.

This incident has been resolved.

We're investigating reports of delays when syncing data in the Neto POS application.

Syncs have returned to normal.

We are currently investigating this issue.

The issue has been identified and a fix is being implemented.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

Scheduled Maintenance We will be completing an account security update for Maropost Identity tonight 5/10/2026. Following this update, all Maropost Identity users will be required to complete an account security reset the next time they log in. Users will be prompted to: - Set a new password using Forgot Password - Save a new set of recovery codes - Configure their authenticator app - Complete Multi-Factor Authentication (MFA) setup Existing recovery codes and authenticator configurations will be reset as part of this process. MFA will be required for all Maropost Identity users going forward, including users who have not previously configured an authenticator. No action is required before the update. Users should follow the instructions presented when they next access Maropost Identity. For more information about the password reset, recovery codes and MFA setup, please refer to our guide: https://galaxy.maropost.com/kb/articles/2475-maropost-identity-password-reset-what-you-need-to-do If you experience any difficulty completing the reset, please contact Maropost Support.

# Maropost Identity – Security Incident Postmortem ‌ **Affected Service:** Maropost Identity \(Login and Authentication\) **Incident Period:** 26–30 September 2026 **Remediation and Global Credential Reset Completed:** 6 October 2026 **Status:** Resolved ## Overview Between 26 and 30 September 2026, Maropost identified unauthorised activity involving Maropost Identity, the authentication service used to securely access Maropost products. Our investigation determined that an external party exploited a security vulnerability within the identity service, allowing unauthorised administrative access. **Importantly, user passwords are stored using secure, one-way cryptographic hashing. Our investigation found no evidence that stored password hashes were extracted or that plaintext passwords were exposed.** Upon identifying the activity, our Engineering and Security teams took immediate action to contain the incident, investigate its impact and implement corrective measures. The identified vulnerability has since been remediated, and a global credential reset was completed on 6 October 2026 as a precautionary security measure. ## What Happened The incident involved a vulnerability within the password-reset functionality of Maropost Identity. This vulnerability was exploited by an unauthorised third party, who subsequently gained elevated access within the identity service. Our investigation identified the following activity: * Unauthorised access to identity account information, including user names and email addresses. * An unusually high volume of password-reset requests across customer and internal accounts. * Unauthorised changes to login credentials and multi-factor authentication \(MFA\) settings on a subset of accounts. Our teams identified abnormal activity on 30 September 2026 and took immediate action to investigate and contain the incident. ## Customer Impact Our investigation identified unauthorised access to Maropost Identity account information, including user names and email addresses. While unauthorised credential and multi-factor authentication \(MFA\) changes were identified on a subset of accounts, Maropost subsequently invalidated existing sessions and completed a global credential reset to protect users. ## Actions Taken to Resolve the Incident Following detection, Maropost's Engineering and Security teams implemented several measures to contain the incident and secure the identity service. **Security Vulnerability Remediation** The affected identity software was upgraded, and verification testing was conducted to confirm the identified vulnerability had been addressed. **Unauthorised Access Containment** Network sources associated with the suspicious activity were blocked, and administrative access controls were strengthened. **Credential and Session Security** Existing user sessions were invalidated, relevant application and integration credentials were rotated, and administrative accounts were reviewed. **Global Password and MFA Reset** On 6 October 2026, Maropost completed a global reset of user passwords, MFA configurations and recovery codes to eliminate the risk of continued access through previously modified credentials. **Account Verification** Additional account reviews were undertaken, including the disabling of unverified accounts identified during the investigation. ## Preventive Measures In addition to the immediate remediation, Maropost is implementing further security improvements to strengthen Maropost Identity and reduce the risk of similar incidents. These improvements include: * Strengthening administrative access restrictions and authentication controls. * Enhancing monitoring and alerting for unusual login and password-reset activity. * Improving application and integration security controls. * Strengthening vulnerability management and software update processes. * Conducting additional security assessments and reviewing incident response procedures. These measures form part of our ongoing commitment to maintaining the security and reliability of Maropost services. ## Do Customers Need to Take Any Action? Customers who successfully reset their Maropost Identity password and reconfigured their multi-factor authentication on or after 6 October 2026 do not need to repeat that process as part of this incident. Customers who have not yet completed the required reset should select **Forgot Password** on the Maropost Identity login page and follow the instructions provided. As a general security precaution, we encourage customers to remain vigilant for unexpected password-reset requests, suspicious emails or attempts to obtain account credentials. Maropost will never request that customers disclose their passwords or MFA recovery codes. For further guidance, please refer to: [Maropost Identity password reset – what you need to do](https://galaxy.maropost.com/kb/articles/2475) If you experience difficulty accessing your account or identify unexpected account activity, please contact our Support team: [Contact Maropost Support](https://galaxy.maropost.com/contact-support) ## Closing Statement Protecting our customers, their accounts and their information remains a priority for Maropost. We recognise the importance of maintaining trust in our services and have taken steps to address the identified vulnerability, secure affected authentication credentials and strengthen the controls protecting Maropost Identity. We will continue reviewing and improving our security practices as part of our ongoing commitment to safeguarding customer information.

As a precautionary security measure, Maropost initiated a password reset for Maropost ID users. When signing in, users may be prompted to reset their password before they can continue accessing their Maropost products. The majority of users are able to complete the password reset successfully. However, we are aware that some users may not receive the password reset email and may therefore be unable to complete the reset or access their platform. If you are unable to access your account because you have not received the password reset email, please lodge a Support request using the form below and our team will assist you with regaining access: Support Request: https://share.hsforms.com/1PF2VNMWnS2al3GnLh8msNQrp8ms

# Maropost Identity – Security Incident Postmortem ‌ **Affected Service:** Maropost Identity \(Login and Authentication\) **Incident Period:** 26–30 September 2026 **Remediation and Global Credential Reset Completed:** 6 October 2026 **Status:** Resolved ## Overview Between 26 and 30 September 2026, Maropost identified unauthorised activity involving Maropost Identity, the authentication service used to securely access Maropost products. Our investigation determined that an external party exploited a security vulnerability within the identity service, allowing unauthorised administrative access. **Importantly, user passwords are stored using secure, one-way cryptographic hashing. Our investigation found no evidence that stored password hashes were extracted or that plaintext passwords were exposed.** Upon identifying the activity, our Engineering and Security teams took immediate action to contain the incident, investigate its impact and implement corrective measures. The identified vulnerability has since been remediated, and a global credential reset was completed on 6 October 2026 as a precautionary security measure. ## What Happened The incident involved a vulnerability within the password-reset functionality of Maropost Identity. This vulnerability was exploited by an unauthorised third party, who subsequently gained elevated access within the identity service. Our investigation identified the following activity: * Unauthorised access to identity account information, including user names and email addresses. * An unusually high volume of password-reset requests across customer and internal accounts. * Unauthorised changes to login credentials and multi-factor authentication \(MFA\) settings on a subset of accounts. Our teams identified abnormal activity on 30 September 2026 and took immediate action to investigate and contain the incident. ## Customer Impact Our investigation identified unauthorised access to Maropost Identity account information, including user names and email addresses. While unauthorised credential and multi-factor authentication \(MFA\) changes were identified on a subset of accounts, Maropost subsequently invalidated existing sessions and completed a global credential reset to protect users. ## Actions Taken to Resolve the Incident Following detection, Maropost's Engineering and Security teams implemented several measures to contain the incident and secure the identity service. **Security Vulnerability Remediation** The affected identity software was upgraded, and verification testing was conducted to confirm the identified vulnerability had been addressed. **Unauthorised Access Containment** Network sources associated with the suspicious activity were blocked, and administrative access controls were strengthened. **Credential and Session Security** Existing user sessions were invalidated, relevant application and integration credentials were rotated, and administrative accounts were reviewed. **Global Password and MFA Reset** On 6 October 2026, Maropost completed a global reset of user passwords, MFA configurations and recovery codes to eliminate the risk of continued access through previously modified credentials. **Account Verification** Additional account reviews were undertaken, including the disabling of unverified accounts identified during the investigation. ## Preventive Measures In addition to the immediate remediation, Maropost is implementing further security improvements to strengthen Maropost Identity and reduce the risk of similar incidents. These improvements include: * Strengthening administrative access restrictions and authentication controls. * Enhancing monitoring and alerting for unusual login and password-reset activity. * Improving application and integration security controls. * Strengthening vulnerability management and software update processes. * Conducting additional security assessments and reviewing incident response procedures. These measures form part of our ongoing commitment to maintaining the security and reliability of Maropost services. ## Do Customers Need to Take Any Action? Customers who successfully reset their Maropost Identity password and reconfigured their multi-factor authentication on or after 6 October 2026 do not need to repeat that process as part of this incident. Customers who have not yet completed the required reset should select **Forgot Password** on the Maropost Identity login page and follow the instructions provided. As a general security precaution, we encourage customers to remain vigilant for unexpected password-reset requests, suspicious emails or attempts to obtain account credentials. Maropost will never request that customers disclose their passwords or MFA recovery codes. For further guidance, please refer to: [Maropost Identity password reset – what you need to do](https://galaxy.maropost.com/kb/articles/2475) If you experience difficulty accessing your account or identify unexpected account activity, please contact our Support team: [Contact Maropost Support](https://galaxy.maropost.com/contact-support) ## Closing Statement Protecting our customers, their accounts and their information remains a priority for Maropost. We recognise the importance of maintaining trust in our services and have taken steps to address the identified vulnerability, secure affected authentication credentials and strengthen the controls protecting Maropost Identity. We will continue reviewing and improving our security practices as part of our ongoing commitment to safeguarding customer information.

We are receiving reports of control panels receiving "We will be back online shortly". Our Development Team are investigating now.

We have identified the issue and our Development Team is working to resolve it as soon as possible.

The issue has been resolved and services are operating as normal. Our team is closely monitoring the situation.

The issue has been resolved and services are operating as normal.

## What happened A feature configuration was enabled for some Neto stores before the corresponding application changes had completed deployment to the production environment. This created an unexpected state for those stores and prevented users from successfully loading the Control Panel after login. ## Impact Affected merchants were temporarily unable to access their Neto Control Panel. The issue was limited in scope, with no broader Neto platform disruption identified. ## Resolution Once the cause was identified, the feature configuration was disabled for the affected stores, restoring Control Panel access. Our teams then monitored the affected environments to confirm that Control Panel access and supporting services remained stable. ## Preventive actions To reduce the likelihood of this occurring again, we are strengthening the deployment process around feature configuration changes. This includes: * Verifying that the required application version has been fully deployed before enabling associated features. * Adding additional checks around deployment and configuration sequencing. * Performing validation and smoke testing immediately following feature activation. * Improving coordination and confirmation of production deployment status before configuration changes are rolled out. We apologise to the merchants affected by this disruption and appreciate their patience while our teams worked to restore access.

We have identified intermittent spikes causing some merchants to receive a “We’ll be back shortly” error when navigating the Control Panel. We are continuing to investigate and make improvements to prevent these errors from occurring.

We are currently seeing increased bot traffic that is bypassing some of our existing safeguards. We have added further protections, which are helping reduce the impact. However, the traffic patterns continue to change, so we are making ongoing adjustments to our mitigations. We are currently using a more aggressive approach and closely monitoring the situation. We will provide further updates as the situation progresses.

Our team continues to monitor the issue and take action to resolve any spikes as quickly as possible. We are still observing intermittent 503 spikes, which may result in brief appearances of the “We’ll be back shortly” page. While these occurrences are becoming less frequent, we continue to work towards a more stable, permanent fix. We will continue to monitor the situation closely and take further action as needed.

We are continuing to monitor.

We continue to see intermittent 503 spikes affecting some merchants, which may result in periods of slowness or brief appearances of the “We’ll be back shortly” page. Our team has identified the traffic patterns contributing to the issue and continues to make adjustments to the additional protections and mitigations already put in place. While we are seeing periods of stability between these spikes, the issue is not yet fully resolved. We are continuing to work on improving stability and will provide another update as the situation progresses

Our investigation has identified increased automated bot traffic contributing to the intermittent slowness and “We’ll be back shortly” errors. As an immediate temporary measure, we are introducing an additional Cloudflare security check on certain filtered product and category pages. Some visitors may briefly see a “Checking your connection” message, which should complete automatically and will only appear once during that visitor’s session. We are continuing to work with Cloudflare on longer-term improvements to strengthen bot detection and platform stability. No action is required from merchants at this time. We will continue to provide updates as the situation progresses.

A fix has now been implemented, and we are monitoring the results. We have introduced additional Cloudflare security protection across Neto merchant sites for certain product search and category filtering requests. This temporary measure is intended to reduce the impact of automated bot traffic contributing to the recent intermittent slowness and “We’ll be back shortly” errors. Some visitors may briefly see a “Checking your connection” message when accessing these pages. This should complete automatically and will only appear once during that visitor’s session. Our team is continuing to closely monitor platform performance and the effectiveness of this change.

This incident has been resolved.

## What Happened Our investigation identified a significant increase in automated bot traffic targeting product filtering, category and search requests. This traffic placed additional load on parts of the Neto platform, resulting in short periods of degraded performance and intermittent 503 errors for some merchants and their customers. ## Resolution We introduced an **interim solution** by adding additional Cloudflare protections to identify and challenge this automated traffic before it reached the Neto platform. Following implementation of these protections on 13 August, platform performance stabilised and we did not observe further significant 503 spikes during the monitoring period. Some visitors may briefly see a **“Checking your connection”** message when accessing certain filtered product and category pages. This check completes automatically and is designed to prevent automated traffic from placing excessive load on the platform. ## Preventive Actions We are continuing to monitor traffic patterns, 503 errors and platform performance closely. We are also continuing to work with Cloudflare on improvements to bot detection so that changing automated traffic patterns can be identified and mitigated more effectively. We apologise for the disruption this incident caused and appreciate your patience while our teams worked to restore and improve platform stability.

On Aug 4, 2026 through Aug 6, 2026, some customers experienced intermittent slowness and errors across parts of the system during several short periods. Our team identified elevated traffic and processing load as the cause, reduced the load, and restored stable performance. The incidents were caused by a large increase of sophisticated bots that Cloudflare miscategorized and treated as human traffic. The issue is resolved and we continue to monitor the system. We are collaborating with Cloudflare to improve detection of these requests and reduce their impact going forward.

We are receiving reports of control panels receiving "We will be back online shortly". Our Development Team are investigating now.

We have identified the issue and our Development Team is working to resolve it as soon as possible.

Our team has deployed a fix and is closely monitoring the situation to ensure services return to normal.

The issue has been resolved and services are operating as normal.

On 27 July 2026, a subset of merchants experienced an issue accessing their control panels. Affected users were shown a “We will be back online shortly” message after attempting to log in. The incident began at **11:48 AM AEST** and was resolved at **1:17 PM AEST**, for a total duration of **1 hour and 29 minutes**. ## What happened During a production software release, a change affecting a security-related control panel configuration caused authenticated requests to fail for a subset of control panels. The issue only affected control panels where the relevant security feature was enabled. Users could reach the login page, but after authentication they were unable to access the control panel. ## Impact Some merchants were temporarily unable to access their control panels and complete administrative tasks. The disruption was limited to a subset of control panels. Services returned to normal once the affected configuration was disabled. ## Timeline * **11:48 AM AEST** – Reports were received of control panels displaying “We will be back online shortly,” and the Development Team began investigating. * **12:35 PM AEST** – The cause of the issue was identified and remediation work began. * **12:55 PM AEST** – A fix was deployed and the service was placed under monitoring. * **1:17 PM AEST** – The issue was confirmed as resolved and services were operating normally. ## Root cause A change included in the production release caused an incorrect security reporting configuration to be generated for affected control panels. This produced a response header that exceeded the supported size limit, causing authenticated control panel requests to fail. ## Resolution The affected security feature was disabled, immediately restoring access to impacted control panels. A permanent code correction is also being implemented so the feature can operate without generating the invalid configuration. ## Preventive actions To reduce the likelihood of a similar incident, we are: * Adding regression coverage for authenticated control panel access when security-reporting features are enabled. * Expanding staging validation for response-header size and security configuration changes. * Improving release checks for feature-toggle combinations before production deployment. * Implementing the permanent code correction and validating it before re-enabling the affected feature. We apologise for the disruption and appreciate the patience of affected merchants while our teams worked to restore access.

We are currently investigating reports of intermittent slowness affecting the Neto Control Panel.

Our team has deployed a fix and is closely monitoring the situation to ensure services return to normal.

This incident has been resolved.

On Jul 24, 2026, some customers experienced intermittent slowness across parts of the service during two short periods. Our team identified elevated traffic and processing load as the cause, took action to reduce the load, and restored stable performance. The issue is now resolved and we are continuing to monitor closely. We are taking steps to improve resilience and help prevent similar issues from recurring.

We are currently investigating reports of intermittent slowness affecting the Neto Control Panel. Users may experience delays while accessing or navigating the Control Panel. Our Engineering teams are actively investigating the issue to identify the root cause and restore normal performance as quickly as possible.

The issue has been identified and a fix is being implemented.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

On **July 23, 2026**, customers experienced intermittent slowness while accessing the **Neto Control Panel**, impacting approximately **20% of requests**. The issue was caused by an infrastructure configuration change that introduced a mix of instance types with different performance characteristics, resulting in some instances becoming overloaded under production traffic. Our engineering team resolved the issue by removing the affected instance type, replacing the impacted instances with compute-optimized instances, and updating the infrastructure configuration to prevent recurrence. We are also implementing additional improvements to our load-balancing configuration and infrastructure validation processes to further enhance platform reliability.

Australia Post has reported an API degradation impacting the performance of Label Printing APIs. For the latest updates, please refer to the Australia Post developer status page: https://status.developers.auspost.com.au/incidents/l1qmd679b34p Please note that we are currently experiencing degraded performance on Label Printing APIs Our teams are currently investigating and we will keep you informed as we work to resolve the issue. Australia Post apologise for any inconvenience caused.

UPDATE from Australia Post Incident status: Monitoring A fix has been implemented and we are monitoring the results. https://status.developers.auspost.com.au/incidents/l1qmd679b34p

Incident resolved This incident has been resolved.

We are currently aware of an issue affecting eBay integration, with an error message appearing stating: "Listing Duration is required. Record Skipped.". Our Development Team is actively investigating the issue.

We are continuing to investigate this issue.

The issue has been identified and a fix is being implemented.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

### Summary On 22 July 2026, merchants using the eBay integration experienced listing updates being skipped with the following error: > “Listing Duration is required. Record Skipped.” The incident was reported at 9:42 AM AEST and resolved at 4:40 PM AEST, with a total duration of approximately 6 hours and 58 minutes. We apologise for the disruption caused to merchants using the eBay integration. ### Impact During the incident, affected eBay listing records could not be processed successfully. This may have prevented merchants from creating or updating listings through the integration. Merchants who saved an eBay listing rule template while the issue was present may also have had some template fields saved without their expected values, despite the correct value continuing to appear in the interface. Other platform services were not affected. ### Root cause An internal data import process used to update shared eBay information was cancelled before it had completed. Because the process had already updated part of the dataset, its cancellation left required eBay information incomplete. This caused subsequent listing updates to fail validation and be skipped. A direct backup and restoration process for the affected shared database was not available. Our Development Team therefore used a point-in-time database recovery process to retrieve and restore the affected information. ### Resolution Our Development Team restored a production database to a separate recovery environment and extracted the affected tables. The recovered information was then restored across each of the relevant production database clusters. The first restoration was validated by Development and Support before the remaining clusters were updated. After the restoration was completed, we monitored the integration to confirm that eBay listing records were processing successfully before marking the incident as resolved. ### Merchant follow-up Merchants who saved an eBay listing rule template while the incident was occurring should re-save the affected template. To identify whether a template was changed during the incident: 1. Log in to your control panel. 2. Open **Reports**. 3. Select the **Staff User Log** report. 4. Enter `ebaytmpl` in the **Page Type** field. 5. Enter `edit` in the **Process** field. 6. Review edits made during the incident window. 7. Note the affected template IDs shown in the **Notes** column. 8. Open and re-save each affected eBay template. The **Listing Duration** field may have been saved as blank even though the interface continued to display “GTC.” Merchants who do not use eBay Business Policies should also review the fields under the template’s **Returns** section, as these fields may need to be re-entered before the template is saved. ### Timeline All times are in AEST on 22 July 2026. * **9:42 AM** – Investigation commenced after reports of eBay listing records being skipped. * **11:24 AM** – Point-in-time database restoration commenced. * **11:37 AM** – The recovery database was successfully restored. * **11:50 AM** – The affected information was extracted and prepared for restoration. * **12:05 PM** – Restoration of the first production database cluster was completed. * **12:11 PM** – Development and Support confirmed that the first restoration was successful. * **12:17 PM** – Restoration commenced across the remaining database clusters. * **12:43 PM** – Restoration was completed across all remaining clusters. * **2:33 PM** – The fix was confirmed as implemented and monitoring commenced. * **4:40 PM** – Monitoring confirmed that the integration was operating successfully and the incident was resolved. ### Follow-up actions We are reviewing the following improvements: * Adding safeguards around the cancellation of data import processes so that partially completed updates cannot leave shared information in an incomplete state. * Improving validation and recovery procedures for shared eBay integration information. * Restoring a working shared-database backup process to provide a faster and more targeted recovery option. * Reviewing whether additional validation can prevent templates from being saved when required underlying values are missing.

We are investigating an issue where some Neto stores are receiving 503 errors on API requests.

Our team has deployed a fix and is closely monitoring the situation.

The issue has been resolved. Our team will continue to closely monitor the situation.

We are experiencing a service disruption for the Neto Control Panel and Storefronts. We are investigating the solution and will post an update as soon as possible.

We have identified the issue and have traced to a corruption in the Network File System. We have made the appropriate corrections and the system has begun recovering.

The fix to the Network File System is resolved and service is restored. We are continuing to monitor the platform to ensure its availability and stability.

On 8 July 2026, we experienced an infrastructure issue that affected all Neto merchant webstores and cPanels for approximately 1 hour and 30 minutes. The incident was caused by a failure within our shared file system infrastructure, which prevented critical services from accessing the files required to serve websites and cPanels. As a result, the platform automatically blocked new requests to protect data consistency, leading to service disruption across all Neto stacks. Our engineering team responded immediately by restoring the affected file system services, failing over to a healthy infrastructure instance, and replacing impacted virtual machines. Once these recovery actions were completed, all webstores and cPanels were restored to normal operation. We are continuing our investigation to determine the underlying reason for the file system process failure. Based on our findings, we will implement additional monitoring and alerting, along with any necessary infrastructure improvements, to help detect and prevent similar incidents in the future.

We are currently investigating an issue related to the error message “Something Went Wrong” affecting users configuring Unified Login.

We are continuing to investigate this issue. We will provide further updates as more information becomes available.

Our team has identified and resolved the issue. If you created a Unified Login account and encountered the “Something went wrong” error, your account was still successfully created. Please use the credentials you set to log in as normal via app.maropost.com If you continue to experience any issues, please contact our support team for assistance.

We are currently investigating a potential service interruption affecting SFTP connections for some Neto stores. During this time, some users may experience difficulty connecting via SFTP.

We have identified an issue affecting DNS resolution for a service domain used by Neto's SFTP infrastructure. Our team is actively working with the relevant service providers to restore normal operation as quickly as possible.

The issue affecting SFTP connectivity has now been resolved, and SFTP services are operating normally.

The issue affecting SFTP connectivity has been resolved and services are operating normally. We apologize for the disruption and appreciate your patience while we worked to resolve the issue.