55 Abnormal Security incidents · 2024年10月 — official updates, affected components, duration and resolution details.
从协调世界时08:50起,Abnormal开始经历影响美国和欧盟客户AI安全邮箱通知的服务中断. AI安全邮箱继续按预期运行,客户安全保护没有受到影响. 然而,受影响的客户目前没有收到通知。 异常现象正在积极地与我们的电子邮件发送供应商合作,为客户恢复通知发送.
从协调世界时08:50起,Abnormal经历了影响美国和欧盟客户AI安全邮箱通知的服务中断. 在整个事件中,AI安全邮箱继续按预期运作,客户安全保护没有受到影响;然而,受影响客户在事件窗口期间没有收到通知. 异常现象与其电子邮件发送供应商合作恢复账户,AI安全邮箱通知现在按预期发送。 事件窗口的所有通知都将处理完毕。 如果您还遇到其他问题, 请联系Abnormal [email protected].
自动翻译自官方事件更新。
从协调世界时13:15起,Abnormal出现了服务中断,影响到进境邮件安全以及美国客户的内线检测和补救,导致处理时间延长。 在这个窗口中,一些信息被延迟了检测和补救。 工程师们在协调世界时14:18恢复了现场处理队列并恢复了内部补救出错率.
自动翻译自官方事件更新。
从协调世界时2026年8月3日17:00起,Abnormal开始为Gov客户体验Account Takeover案例细节出问题. 客户可能会遇到在门户内装入 " 接管账户 " 案件细节的问题。 账户接管探测和警报工作继续全面运作。 工程组正积极调查并努力恢复全部功能. 下一次更新将在1小时后或获得进一步资料后提供.
工程组已查明了问题,并正在积极努力部署一个固定装置。 账户接管探测和警报工作继续全面运作。 下一次更新将在获得更多信息后提供.
工程组继续努力寻求解决。 取款账户内的时间线数据现在正在按预期加载;但是,案件细节和实体统计数据仍未提供。 目前正在部署一个固定装置。 下一次更新将在获得更多信息后提供.
工程组解决了影响Gov地区 " 接管账户 " 案件细节的主要问题。 案件细节和时间表数据正在按预期加载。 其余的次要问题将另行处理。 非正常人认为这个事件解决了. 如有进一步问题,请联系支持@aboricalsecurity.com.
自动翻译自官方事件更新。
在协调世界时22:10至协调世界时2026年7月27日22:50之间,Abnormal经历了一次服务中断,影响了美国和欧盟地区Google Workspace客户的Inbound Email Security,Inline和Graymail处理. 在此期间,入境邮件处理被暂时中断,这可能造成电子邮件检测和补救的延误. 工程组解决了问题,全部恢复服务. 受影响的窗口的所有邮件都已成功重新处理 。 若遇到其他问题,请联系支援团队@abmonicsecurity.com.
自动翻译自官方事件更新。
Starting at 22:00 UTC on July 7, 2026, Abnormal began experiencing a service disruption impacting Inbound Email Security detection and email remediation for US customers. During this time, inline customers may have emails delivered without security scoring or remediation, and Inbound Email Security detection is degraded. Additionally, AI Security Mailbox is experiencing issues within the portal which the Abnormal team is actively investigating. Our team is working to restore full functionality. The next update will be provided within 1 hour or sooner as more information becomes available.
Abnormal continues to experience a service disruption impacting Inbound Email Security detection and email remediation for US tenant customers that began at 22:00 UTC on July 7, 2026. During this time, emails may be delivered without full security analysis, and some customers may be unable to login to the Abnormal Portal. The Abnormal engineering team continues to actively work on restoring full functionality. The next update will be provided within 1 hour or sooner as more information becomes available.
As of 00:23 UTC on July 8, 2026, AI Security Mailbox and Portal services have been fully restored for US tenant customers. The Abnormal engineering team is currently deploying a mitigation for Inbound Email Security services, which are expected to be fully restored within the next 30 minutes. During this time, some emails may still be delivered without full security analysis. The next update will be provided once Inbound Email Security services are confirmed restored.
The Abnormal engineering team continues to work on restoring full Inbound Email Security services for US tenant customers. During this time, some emails may still be delivered without full security analysis. Additionally, Abnormal has identified that this issue is beginning to impact EU tenant customers, which the engineering team is actively addressing. The next update will be provided within 60 minutes or sooner as more information becomes available.
Abnormal has begun to see early signs of recovery for Inbound Email Security services impacting US and EU tenant customers. The Abnormal engineering team continues to monitor for full recovery. During this time, some emails may still experience delayed security analysis. The next update will be provided once full recovery is confirmed.
As of 04:44 UTC on July 8, 2026, all services have fully recovered and are now live processing traffic for US and EU tenant customers. Abnormal will reprocess all messages received during the impact window to ensure full security analysis is applied. If you experience any continued issues, please reach out to the support team at [email protected].
Between 16:45 UTC and 17:25 UTC on June 5, 2026, Abnormal experienced message remediation delays affecting Inbound Email Security for GOV customers. During this time, some emails may have experienced delayed remediation. The Abnormal engineering team actively worked to address the issue, and service was fully restored as of 17:25 UTC. All emails from the impacted window have since been reprocessed. If you experience any further issues, please reach out to our support team at [email protected].
Between 20:00 UTC and 21:22 UTC on June 4, 2026, Abnormal experienced a service disruption impacting inbound email ingestion for all inline US customers. During this time, inbound emails sent to customers may not have been ingested or processed. The Abnormal engineering team identified and resolved the root cause, and service was confirmed recovering as of 21:22 UTC. Emails affected during the incident window have been reprocessed. If you experience any further issues, please reach out to our support team at [email protected].
Starting at 17:45 UTC on June 2, 2026, Abnormal began experiencing a service disruption affecting email scoring, detection, and remediation for Inbound Email Security in the EU region. EU customers may experience emails not being analyzed or remediated during this time. The engineering team is actively investigating and working to restore full functionality. The next update will be provided within 1 hour or sooner as more information becomes available.
Starting at 17:45 UTC on June 2, 2026, Abnormal experienced a service disruption affecting email detection and remediation for Inbound Email Security customers in the EU region. Additionally, between 18:00 UTC and 19:00 UTC, US customers experienced degraded attack detection and AI Security Mailbox functionality. Abnormal is now beginning to see recovery across impacted services. The engineering team continues to monitor as systems restore to full operational capacity. Any emails from the impacted window will be reprocessed. A further update will be provided once full recovery is confirmed.
Starting at 17:45 UTC on June 2, 2026, Abnormal experienced a service disruption affecting email detection and remediation for Inbound Email Security customers in the EU region. Additionally, between 18:00 UTC and 19:00 UTC, US customers experienced degraded AI Security Mailbox functionality. As of 19:20 UTC, all services have been restored and live traffic is processing normally across both regions. Abnormal is continuing to work through retry queues to reprocess any emails from the impacted window. If you experience any further issues, please reach out to our support team at [email protected].
Starting at 04:27 UTC on May 29, 2026, Microsoft is experiencing degraded delivery of M365 sign-in audit logs due to an issue on Microsoft's infrastructure. As a result, customers using Account Takeover detection with Microsoft M365 may see a delay of up to 90 minutes in the creation of detection cases based on sign-in activity. No sign-in data is being lost, and Abnormal has adjusted processing to account for the delay and ensure no detections are missed. All other Account Takeover data sources continue to operate at full capacity. Abnormal is actively monitoring the situation and will provide updates as it evolves. If you have any questions, please reach out to Abnormal support at [email protected].
We are continuing to investigate this issue.
Microsoft has confirmed that the degraded delivery of M365 sign-in audit logs was caused by a power event in their West US 2 datacenter, which began at 04:27 UTC on May 29, 2026. Microsoft has reported that their service is on a recovery path and is currently processing the accumulated backlog, including sign-in stream data. As a result, customers using Account Takeover detection with Microsoft M365 may continue to experience delays in the creation of detection cases based on sign-in activity until the backlog is fully consumed. No sign-in data has been lost, and Abnormal has adjusted processing to account for the delay and ensure no detections are missed. All other Account Takeover data sources continue to operate at full capacity. Abnormal will continue to monitor and provide a further update once Microsoft confirms full recovery. If you have any questions, please reach out to Abnormal support at [email protected].
Microsoft has confirmed the root cause of the degraded M365 sign-in audit log delivery has been fixed and services are currently recovering. Microsoft estimates full recovery within approximately 7 hours. Once Microsoft services complete recovery, Abnormal expects Account Takeover detection to begin processing normally and will work through the backlog of sign-in events from this incident. No data has been lost. Abnormal will post a final resolved update once Microsoft confirms full restoration and backlog processing is complete.
Microsoft services have fully recovered from the degraded M365 sign-in audit log delivery, and Abnormal services have also recovered as of 09:41 UTC on May 30, 2026. Abnormal engineering has initiated a reprocess to ensure all Account Takeover detections from the impacted time window are properly processed. No sign-in data was lost during this event. If you experience any further issues, please reach out to Abnormal support at [email protected].
Starting at 22:00 UTC on May 18, 2026, Abnormal identified an increase in legitimate emails being incorrectly flagged as malicious and remediated, impacting Inbound Email Security and AI Security Mailbox. The engineering team identified and disabled the rule responsible for falsely flagging these emails at 01:03 UTC on May 19, 2026. Messages affected during the impact window will be reprocessed.
Between 00:19 UTC and 00:49 UTC, Abnormal experienced message remediation delays affecting Inbound Email Security for US customers. During this approximately 30-minute window, email remediation was temporarily delayed due to a backend database issue. The engineering team stopped the contributing process and remediation services recovered. All messages from the impacted window have since been reprocessed. If you experience any further issues, please reach out to our support team at [email protected]
Abnormal is currently investigating an issue affecting Security Orchestration, Automation and Response (SOAR) API functionality for US customers. Customers utilizing SOAR API integrations may experience errors when attempting to query messages, attachments, and threat data. Some Portal functionality that relies on the same data source may also be intermittently affected. The Abnormal engineering team is actively investigating the root cause and working toward resolution. Email detection and remediation services remain fully operational and are not affected by this incident.
Between approximately May 2, 2026, and May 4, 2026 at 18:45 UTC, Abnormal experienced a service disruption affecting Security Orchestration, Automation and Response (SOAR) API functionality, Portal data retrieval, and Threat Log display for US customers. During this time, customers utilizing SOAR API integrations may have experienced errors when attempting to query messages, attachments, and threat data. The Abnormal engineering team has deployed a fix and confirmed that SOAR API is functioning as expected. All affected services have been restored to normal operation. If you experience any further issues, please reach out to the Abnormal support team at [email protected].
Starting at 00:30 UTC on April 28, 2026, Abnormal identified an issue impacting email detection accuracy, which may result in some legitimate emails being incorrectly flagged. Abnormal engineering is actively investigating and implementing corrective measures to restore full detection accuracy. Email remediation services remain operational. Abnormal will provide an update within 1 hour or as new information becomes available.
Abnormal engineering has identified the root cause and is working to implement a fix to fully restore email protection. Abnormal will provide an additional update within 1 hour or as new information becomes available.
Between 00:30 UTC and 08:10 UTC on April 28, 2026, Abnormal experienced an issue impacting email detection and scoring accuracy, which may have resulted in some legitimate emails being incorrectly flagged. Abnormal engineering identified the root cause, implemented a fix, and confirmed that all email detection and scoring services have been fully restored. All messages received during the impact window will be replayed to ensure complete email protection coverage. If you experience any further issues, please reach out to the support team at [email protected].
Starting at approximately 19:00 UTC on April 8, 2026, Abnormal began receiving reports of customers being unable to access the Customer Support Portal. Some customers may experience intermittent or complete inaccessibility when attempting to log in or navigate the Customer Support Portal. The Abnormal engineering team is actively investigating the underlying cause of the issue.
Starting at approximately 19:00 UTC on April 8, 2026, Abnormal received reports of customers being unable to access the Customer Support Portal. Some customers experienced intermittent or complete inaccessibility when attempting to log in or navigate the Portal. The Abnormal engineering team identified and resolved the underlying cause. As of 16:40 UTC on April 9, 2026, Customer Support Portal access has been fully restored and customers are able to successfully log in.
Starting at 13:30 UTC on April 8, 2026, Abnormal began experiencing an issue with receipt of email-based support case submissions and replies due to a vendor caused issue. Customer emails to [email protected] or [email protected] may be delayed. Abnormal support is actively monitoring the issue and will provide further updates once additional information is received from the vendor. In the meantime, customers are encouraged to submit support inquiries through the Abnormal Customer Support Portal at https://abnormalsecurity.my.site.com/support/s/.
Starting at 13:30 UTC on April 8, 2026, Abnormal experienced an issue with the email-based support case submission process due to a vendor-caused outage. Customers who submitted support requests by emailing [email protected] or [email protected] may have experienced failures when attempting to create new cases. The vendor has confirmed that service has been restored, and Abnormal has verified that emails are now flowing as expected. Customers may resume submitting support requests via email.
Between 09:53 UTC on April 4, 2026 and 17:38 UTC on April 6, 2026, Abnormal experienced an issue within the Gov Portal affecting the AI Security Mailbox Analyzed tab and remediation information cards on the message details page. During this time, Gov customers may have experienced failures when loading the AI Security Mailbox Analyzed tab, and remediation details may have appeared incomplete or failed to display on the message details page. The Abnormal engineering team identified and resolved the underlying issue, and full functionality has been restored. If you experience any further issues, please reach out to the support team at [email protected].
Starting at approximately 16:00 UTC on March 26, 2026, Abnormal began experiencing an issue with AI Security Mailbox report processing. US and EU customers may experience failures in the processing of new reports submitted to AI Security Mailbox. Abnormal engineering is actively investigating and working to restore full functionality.
Between approximately 16:00 UTC and 23:50 UTC on March 26, 2026, Abnormal experienced a service disruption impacting AI Security Mailbox report processing for US and EU customers. During this time, new reports submitted to AI Security Mailbox may not have been processed as expected. Abnormal engineers deployed a fix at 23:50 UTC and confirmed that services are now processing in real time. Any reports submitted during the impacted window are currently being reprocessed and are expected to be fully completed within the next few hours. If you experience any further issues, please reach out to the Abnormal support team at [email protected].
Starting around 22:23 UTC on March 16, 2026, Abnormal began experiencing a service disruption impacting Inbound Email Security detection and remediation for some US customers. Additionally, inline email processing is affected during this time, and malicious emails may not be properly detected or remediated. Abnormal's engineering team is actively investigating and working to restore full functionality. The next update will be provided within 1 hour or when further information is obtained.
Starting around 22:23 UTC on March 16, 2026, Abnormal experienced a service disruption impacting Inbound Email Security detection and remediation for some US customers. During this time, inline email processing was also affected, and some emails may not have been properly detected or remediated. Abnormal's engineering team actively worked to address the issue, and all services were fully restored as of 23:56 UTC. Detection and remediation are now operating as expected for US customers. If you experience any further issues, please reach out to Abnormal's support team at [email protected].
Starting around 14:26 UTC, Abnormal began experiencing an issue with the EU Portal being inaccessible and displaying an error. EU customers may be unable to access the Abnormal Portal during this time. Email detection and remediation services remain fully operational and are not impacted. The engineering team is actively working to restore access to the EU Portal.
Starting around 14:40 UTC, Abnormal experienced an issue with the EU Portal being inaccessible and displaying an error to EU customers. Email detection and remediation services were not impacted during this time and continued to operate normally. Access to the Abnormal Portal for EU customers has been restored as of 15:01 UTC. If you experience any further issues, please reach out to the Abnormal support team at [email protected].
Starting at 18:00 UTC on March 12, 2026, Abnormal identified an issue where messages flagged as attack, spam, or borderline may experience delays in appearing within the Threat Log for Gov customers. Inbound Email Security detection and remediation remain fully functional, and all threats continue to be identified and acted upon as expected. The impact is limited to a delay in Threat Log visibility within the Portal.
Between 18:00 UTC and 20:40 UTC on March 12, 2026, Abnormal identified an issue where messages flagged as attack, spam, or borderline experienced delays in appearing within the Threat Log for Gov customers. Inbound Email Security detection and remediation remained fully functional throughout the incident, and all threats continued to be identified and acted upon as expected. Abnormal engineers redeployed the affected services and confirmed recovery as of 20:40 UTC. All messages during the incident window were queued and have been processed. If you experience any further issues, please reach out to Abnormal support at [email protected].