Security Update: October 2026 Incident Report

On 19 October, an attacker gained unauthorised access to parts of our internal infrastructure and accessed usernames and email addresses of our customers. Based on our findings, there is no evidence that customer passwords, payment information, or account data were affected; thus, no action is required on customers’ behalf.

The attack has been mitigated, and affected systems have been secured and are all operating as normal. One of our products, AI Studio, remains disabled and will be reinstated as soon as all required safeguards are in place.

Protecting the data our customers and partners entrust to us is a responsibility we don’t take lightly, and we are treating this with the urgency it deserves. The investigation is still ongoing, and we will update the blog post and reach out to customers in case the impact changes.

How the incident developed 

On 19 October, the attacker accessed a component of our AI Studio service. While no customer data was stored in that specific location, the component held internal credentials which were used the same evening to establish access to our cloud environment.

On 23 October, the attacker began using that access across our systems. This was the point at which a system holding user account data was reached, leading to the access of usernames and email addresses.

Our security teams detected the intrusion within hours after spotting unusual automated traffic to an internal administrative panel. This traffic was recognised as anomalous and immediately escalated. We removed the initial attack vector that same day, and the last attacker-linked activity in our systems was mitigated on 25 October.

Subsequently, the following actions have been done to mitigate the incident:

• Endpoints that showed anomalous activity have been immediately isolated.

• Affected services have been identified, compromised integrations and identities were disabled, leaked credentials and associated sessions were revoked, and affected automation was suspended. 

• Accessible secrets, identities, and systems were investigated to expand containment and block persistence or alternative access paths. 

• Active sessions have been reset to force reconnections and re-authentications for new identities.

• Stricter firewall rules have been applied to prevent lateral movement. 

What we found

As noted above, our investigation shows no customer information exposure other than usernames and emails. We found no evidence that the attacker attempted to access customer passwords, which are stored protected using one-way Argon2 hashing or AES-256-GCM encryption.

The attacker gained access to internal Oxylabs infrastructure, including some of the internal credentials, repositories, infrastructure management systems, and internal administrative tools. 

It also appears that the attacker was seeking access to privileged accounts registered at our own email domain, however, these queries resulted only in retrieving internal test accounts with no access to any sensitive systems. Nevertheless, accounts were suspended on detection and, even if exploited, could not have affected any customer service. 

Recovery 

Rather than patch individual systems, we rebuilt the potentially affected ones: a new credential store, secrets management system, certificate authority, and a full rotation of credentials across the organisation. The AI Studio was disabled and will be reinstated only after all necessary measures to secure it are taken. We are adding detection coverage and will be commissioning additional external security audits of our infrastructure and internal security controls. We also informed the local data protection authority regarding the incident. 

We will share updates as our investigation progresses.