59 Abnormal Security incidents · 2024年10月 — official updates, affected components, duration and resolution details.
从协调世界时2026年10月8日14:35起,Abnormal开始利用在美国和欧盟托管的Google工作空间来调查影响一些教育相关客户的问题. 在此期间,一些为.EDU邮箱寄入的电子邮件可能无法实时评价,这可能会暂时减少受影响邮箱的电子邮件检测范围. 异常现象正在积极努力恢复正常处理,并将在获得更多信息后提供最新情况.
异常现象继续与Google Support合作来缓解这一问题,同时实施一个短期解决方案来为受影响的客户恢复正常的电子邮件处理. 一旦获得更多信息,将提供更多最新资料.
截至协调世界时2026年10月8日21:10,影响一些托管的美国和欧盟教育客户的入境电子邮件安全检测和补救的服务中断已经得到解决. 受影响邮箱的电子邮件处理已恢复正常,服务在过去30分钟里保持了健康。 事件窗口中的所有受影响消息都将被重新处理,以确保完整的电子邮件安全.
自动翻译自官方事件更新。
从协调世界时2026年9月30日23:30左右开始,Abnormal开始遭遇服务中断,影响到一些托管的美国客户的入境电子邮件安全检测和补救. 在这段时间内,内部电子邮件也不可能像预期的那样被检测出或补救。 异常工程师正在积极努力恢复服务,下一次更新将在一个小时之内提供,或者在获得更多信息后提前提供.
异常工程师已经查明了这个问题,并正在积极制定恢复全面服务的固定办法。 下一次更新将在一个小时之内提供,如果获得更多信息,则提前提供.
2026年10月1日协调世界时02:15全面恢复了对东道主美国客户的电子邮件检测和补救服务. 异常工程师正在处理事件窗口期间未能处理的信息,预计在2026年10月1日约03:15 UTC完成. 如有进一步问题,请联系Adormal [email protected].
自动翻译自官方事件更新。
从协调世界时17:50左右开始,Abnormal开始出现服务中断,影响到政府客户的门户网站接入. 在此期间,受影响的客户可能无法进入门户网站。 电子邮件检测、评分和补救服务仍然充分运作,客户安全保护没有受到影响。 Abority的工程团队正在积极调查并努力恢复全部功能. 异常情况将在60分钟内提供下一次更新,或者在获得更多信息后尽早提供。 如果您遇到其他问题, 请联系Abnority的支援团队@ abnoralsecurity.com.
截至协调世界时18:57,Abnormal已恢复服务,并证实已经恢复了政府客户的门户网站接入. UTC17:50左右开始的服务中断已经完全解决,所有门户功能现在都正常运行. 电子邮件检测、评分和补救服务在整个过程中仍然全面运作,客户安全保护没有受到影响。 如果您遇到其他问题, 请联系Abnority的支援团队@ abnoralsecurity.com.
自动翻译自官方事件更新。
从协调世界时16:50起,Abnormal开始出现服务中断,影响到GOV客户的电子邮件评分、检测和补救。 在此期间,GOV客户可能会遇到在此期间没有被分析或补救的电子邮件. 工程组正积极调查并努力恢复全部功能. 下一次更新将在1小时之内提供,或者在获得更多信息后提前提供。 如果您遇到其他问题, 请联系Abnority的支援团队@ abnoralsecurity.com.
从协调世界时16:50左右开始,Abnormal在美国政府地区的客户电子邮件分数方面出现了延误,一些消息比通常需要更长的时间才能得分. 非正常识别出原因,应用了固定,并且从解析时间起完全恢复了正常的分数性能. 在此期间,对电子邮件威胁的侦测和补救继续按预期进行。 受撞击窗口的所有信件都会被重放并打入分数,所以不会漏掉信件. 如果您遇到其他问题, 请联系Abnority的支援团队@ abnoralsecurity.com.
自动翻译自官方事件更新。
从协调世界时08:50起,Abnormal开始经历影响美国和欧盟客户AI安全邮箱通知的服务中断. AI安全邮箱继续按预期运行,客户安全保护没有受到影响. 然而,受影响的客户目前没有收到通知。 异常现象正在积极地与我们的电子邮件发送供应商合作,为客户恢复通知发送.
从协调世界时08:50起,Abnormal经历了影响美国和欧盟客户AI安全邮箱通知的服务中断. 在整个事件中,AI安全邮箱继续按预期运作,客户安全保护没有受到影响;然而,受影响客户在事件窗口期间没有收到通知. 异常现象与其电子邮件发送供应商合作恢复账户,AI安全邮箱通知现在按预期发送。 事件窗口的所有通知都将处理完毕。 如果您还遇到其他问题, 请联系Abnormal [email protected].
自动翻译自官方事件更新。
从协调世界时13:15起,Abnormal出现了服务中断,影响到进境邮件安全以及美国客户的内线检测和补救,导致处理时间延长。 在这个窗口中,一些信息被延迟了检测和补救。 工程师们在协调世界时14:18恢复了现场处理队列并恢复了内部补救出错率.
自动翻译自官方事件更新。
从协调世界时2026年8月3日17:00起,Abnormal开始为Gov客户体验Account Takeover案例细节出问题. 客户可能会遇到在门户内装入 " 接管账户 " 案件细节的问题。 账户接管探测和警报工作继续全面运作。 工程组正积极调查并努力恢复全部功能. 下一次更新将在1小时后或获得进一步资料后提供.
工程组已查明了问题,并正在积极努力部署一个固定装置。 账户接管探测和警报工作继续全面运作。 下一次更新将在获得更多信息后提供.
工程组继续努力寻求解决。 取款账户内的时间线数据现在正在按预期加载;但是,案件细节和实体统计数据仍未提供。 目前正在部署一个固定装置。 下一次更新将在获得更多信息后提供.
工程组解决了影响Gov地区 " 接管账户 " 案件细节的主要问题。 案件细节和时间表数据正在按预期加载。 其余的次要问题将另行处理。 非正常人认为这个事件解决了. 如有进一步问题,请联系支持@aboricalsecurity.com.
自动翻译自官方事件更新。
在协调世界时22:10至协调世界时2026年7月27日22:50之间,Abnormal经历了一次服务中断,影响了美国和欧盟地区Google Workspace客户的Inbound Email Security,Inline和Graymail处理. 在此期间,入境邮件处理被暂时中断,这可能造成电子邮件检测和补救的延误. 工程组解决了问题,全部恢复服务. 受影响的窗口的所有邮件都已成功重新处理 。 若遇到其他问题,请联系支援团队@abmonicsecurity.com.
自动翻译自官方事件更新。
Starting at 22:00 UTC on July 7, 2026, Abnormal began experiencing a service disruption impacting Inbound Email Security detection and email remediation for US customers. During this time, inline customers may have emails delivered without security scoring or remediation, and Inbound Email Security detection is degraded. Additionally, AI Security Mailbox is experiencing issues within the portal which the Abnormal team is actively investigating. Our team is working to restore full functionality. The next update will be provided within 1 hour or sooner as more information becomes available.
Abnormal continues to experience a service disruption impacting Inbound Email Security detection and email remediation for US tenant customers that began at 22:00 UTC on July 7, 2026. During this time, emails may be delivered without full security analysis, and some customers may be unable to login to the Abnormal Portal. The Abnormal engineering team continues to actively work on restoring full functionality. The next update will be provided within 1 hour or sooner as more information becomes available.
As of 00:23 UTC on July 8, 2026, AI Security Mailbox and Portal services have been fully restored for US tenant customers. The Abnormal engineering team is currently deploying a mitigation for Inbound Email Security services, which are expected to be fully restored within the next 30 minutes. During this time, some emails may still be delivered without full security analysis. The next update will be provided once Inbound Email Security services are confirmed restored.
The Abnormal engineering team continues to work on restoring full Inbound Email Security services for US tenant customers. During this time, some emails may still be delivered without full security analysis. Additionally, Abnormal has identified that this issue is beginning to impact EU tenant customers, which the engineering team is actively addressing. The next update will be provided within 60 minutes or sooner as more information becomes available.
Abnormal has begun to see early signs of recovery for Inbound Email Security services impacting US and EU tenant customers. The Abnormal engineering team continues to monitor for full recovery. During this time, some emails may still experience delayed security analysis. The next update will be provided once full recovery is confirmed.
As of 04:44 UTC on July 8, 2026, all services have fully recovered and are now live processing traffic for US and EU tenant customers. Abnormal will reprocess all messages received during the impact window to ensure full security analysis is applied. If you experience any continued issues, please reach out to the support team at [email protected].
Between 16:45 UTC and 17:25 UTC on June 5, 2026, Abnormal experienced message remediation delays affecting Inbound Email Security for GOV customers. During this time, some emails may have experienced delayed remediation. The Abnormal engineering team actively worked to address the issue, and service was fully restored as of 17:25 UTC. All emails from the impacted window have since been reprocessed. If you experience any further issues, please reach out to our support team at [email protected].
Between 20:00 UTC and 21:22 UTC on June 4, 2026, Abnormal experienced a service disruption impacting inbound email ingestion for all inline US customers. During this time, inbound emails sent to customers may not have been ingested or processed. The Abnormal engineering team identified and resolved the root cause, and service was confirmed recovering as of 21:22 UTC. Emails affected during the incident window have been reprocessed. If you experience any further issues, please reach out to our support team at [email protected].
Starting at 17:45 UTC on June 2, 2026, Abnormal began experiencing a service disruption affecting email scoring, detection, and remediation for Inbound Email Security in the EU region. EU customers may experience emails not being analyzed or remediated during this time. The engineering team is actively investigating and working to restore full functionality. The next update will be provided within 1 hour or sooner as more information becomes available.
Starting at 17:45 UTC on June 2, 2026, Abnormal experienced a service disruption affecting email detection and remediation for Inbound Email Security customers in the EU region. Additionally, between 18:00 UTC and 19:00 UTC, US customers experienced degraded attack detection and AI Security Mailbox functionality. Abnormal is now beginning to see recovery across impacted services. The engineering team continues to monitor as systems restore to full operational capacity. Any emails from the impacted window will be reprocessed. A further update will be provided once full recovery is confirmed.
Starting at 17:45 UTC on June 2, 2026, Abnormal experienced a service disruption affecting email detection and remediation for Inbound Email Security customers in the EU region. Additionally, between 18:00 UTC and 19:00 UTC, US customers experienced degraded AI Security Mailbox functionality. As of 19:20 UTC, all services have been restored and live traffic is processing normally across both regions. Abnormal is continuing to work through retry queues to reprocess any emails from the impacted window. If you experience any further issues, please reach out to our support team at [email protected].
Starting at 04:27 UTC on May 29, 2026, Microsoft is experiencing degraded delivery of M365 sign-in audit logs due to an issue on Microsoft's infrastructure. As a result, customers using Account Takeover detection with Microsoft M365 may see a delay of up to 90 minutes in the creation of detection cases based on sign-in activity. No sign-in data is being lost, and Abnormal has adjusted processing to account for the delay and ensure no detections are missed. All other Account Takeover data sources continue to operate at full capacity. Abnormal is actively monitoring the situation and will provide updates as it evolves. If you have any questions, please reach out to Abnormal support at [email protected].
We are continuing to investigate this issue.
Microsoft has confirmed that the degraded delivery of M365 sign-in audit logs was caused by a power event in their West US 2 datacenter, which began at 04:27 UTC on May 29, 2026. Microsoft has reported that their service is on a recovery path and is currently processing the accumulated backlog, including sign-in stream data. As a result, customers using Account Takeover detection with Microsoft M365 may continue to experience delays in the creation of detection cases based on sign-in activity until the backlog is fully consumed. No sign-in data has been lost, and Abnormal has adjusted processing to account for the delay and ensure no detections are missed. All other Account Takeover data sources continue to operate at full capacity. Abnormal will continue to monitor and provide a further update once Microsoft confirms full recovery. If you have any questions, please reach out to Abnormal support at [email protected].
Microsoft has confirmed the root cause of the degraded M365 sign-in audit log delivery has been fixed and services are currently recovering. Microsoft estimates full recovery within approximately 7 hours. Once Microsoft services complete recovery, Abnormal expects Account Takeover detection to begin processing normally and will work through the backlog of sign-in events from this incident. No data has been lost. Abnormal will post a final resolved update once Microsoft confirms full restoration and backlog processing is complete.
Microsoft services have fully recovered from the degraded M365 sign-in audit log delivery, and Abnormal services have also recovered as of 09:41 UTC on May 30, 2026. Abnormal engineering has initiated a reprocess to ensure all Account Takeover detections from the impacted time window are properly processed. No sign-in data was lost during this event. If you experience any further issues, please reach out to Abnormal support at [email protected].
Starting at 22:00 UTC on May 18, 2026, Abnormal identified an increase in legitimate emails being incorrectly flagged as malicious and remediated, impacting Inbound Email Security and AI Security Mailbox. The engineering team identified and disabled the rule responsible for falsely flagging these emails at 01:03 UTC on May 19, 2026. Messages affected during the impact window will be reprocessed.
Between 00:19 UTC and 00:49 UTC, Abnormal experienced message remediation delays affecting Inbound Email Security for US customers. During this approximately 30-minute window, email remediation was temporarily delayed due to a backend database issue. The engineering team stopped the contributing process and remediation services recovered. All messages from the impacted window have since been reprocessed. If you experience any further issues, please reach out to our support team at [email protected]
Abnormal is currently investigating an issue affecting Security Orchestration, Automation and Response (SOAR) API functionality for US customers. Customers utilizing SOAR API integrations may experience errors when attempting to query messages, attachments, and threat data. Some Portal functionality that relies on the same data source may also be intermittently affected. The Abnormal engineering team is actively investigating the root cause and working toward resolution. Email detection and remediation services remain fully operational and are not affected by this incident.
Between approximately May 2, 2026, and May 4, 2026 at 18:45 UTC, Abnormal experienced a service disruption affecting Security Orchestration, Automation and Response (SOAR) API functionality, Portal data retrieval, and Threat Log display for US customers. During this time, customers utilizing SOAR API integrations may have experienced errors when attempting to query messages, attachments, and threat data. The Abnormal engineering team has deployed a fix and confirmed that SOAR API is functioning as expected. All affected services have been restored to normal operation. If you experience any further issues, please reach out to the Abnormal support team at [email protected].
Starting at 00:30 UTC on April 28, 2026, Abnormal identified an issue impacting email detection accuracy, which may result in some legitimate emails being incorrectly flagged. Abnormal engineering is actively investigating and implementing corrective measures to restore full detection accuracy. Email remediation services remain operational. Abnormal will provide an update within 1 hour or as new information becomes available.
Abnormal engineering has identified the root cause and is working to implement a fix to fully restore email protection. Abnormal will provide an additional update within 1 hour or as new information becomes available.
Between 00:30 UTC and 08:10 UTC on April 28, 2026, Abnormal experienced an issue impacting email detection and scoring accuracy, which may have resulted in some legitimate emails being incorrectly flagged. Abnormal engineering identified the root cause, implemented a fix, and confirmed that all email detection and scoring services have been fully restored. All messages received during the impact window will be replayed to ensure complete email protection coverage. If you experience any further issues, please reach out to the support team at [email protected].
Starting at approximately 19:00 UTC on April 8, 2026, Abnormal began receiving reports of customers being unable to access the Customer Support Portal. Some customers may experience intermittent or complete inaccessibility when attempting to log in or navigate the Customer Support Portal. The Abnormal engineering team is actively investigating the underlying cause of the issue.
Starting at approximately 19:00 UTC on April 8, 2026, Abnormal received reports of customers being unable to access the Customer Support Portal. Some customers experienced intermittent or complete inaccessibility when attempting to log in or navigate the Portal. The Abnormal engineering team identified and resolved the underlying cause. As of 16:40 UTC on April 9, 2026, Customer Support Portal access has been fully restored and customers are able to successfully log in.
Starting at 13:30 UTC on April 8, 2026, Abnormal began experiencing an issue with receipt of email-based support case submissions and replies due to a vendor caused issue. Customer emails to [email protected] or [email protected] may be delayed. Abnormal support is actively monitoring the issue and will provide further updates once additional information is received from the vendor. In the meantime, customers are encouraged to submit support inquiries through the Abnormal Customer Support Portal at https://abnormalsecurity.my.site.com/support/s/.
Starting at 13:30 UTC on April 8, 2026, Abnormal experienced an issue with the email-based support case submission process due to a vendor-caused outage. Customers who submitted support requests by emailing [email protected] or [email protected] may have experienced failures when attempting to create new cases. The vendor has confirmed that service has been restored, and Abnormal has verified that emails are now flowing as expected. Customers may resume submitting support requests via email.
Between 09:53 UTC on April 4, 2026 and 17:38 UTC on April 6, 2026, Abnormal experienced an issue within the Gov Portal affecting the AI Security Mailbox Analyzed tab and remediation information cards on the message details page. During this time, Gov customers may have experienced failures when loading the AI Security Mailbox Analyzed tab, and remediation details may have appeared incomplete or failed to display on the message details page. The Abnormal engineering team identified and resolved the underlying issue, and full functionality has been restored. If you experience any further issues, please reach out to the support team at [email protected].
