{
  "meta": {
    "version": "v1",
    "pricing": {
      "public": {
        "label": "Public",
        "description": "Read-only API access for lightweight status checks and public integrations."
      },
      "premium": {
        "label": "Premium",
        "description": "API keys with higher hourly quotas, plus Slack, Teams, Discord, webhook, and email outage alerts across your vendor stack."
      }
    },
    "generatedAt": "2026-10-27T15:29:54.723Z"
  },
  "data": {
    "id": "incident_statuspage_pantheon_z6fjft9bxt34",
    "slug": "pantheon-security-advisory-unauthorized-access-via-credential-stuffing-2026-09-11",
    "title": "Security Advisory: Unauthorized Access to Customer Accounts via a Look-alike Sign-in Page",
    "summary": "Security Advisory: Unauthorized Access to Customer Accounts via a Look-alike Sign-in Page",
    "status": "resolved",
    "stale": false,
    "severity": "minor",
    "startedAt": "2026-09-12T04:13:15.303+00:00",
    "updatedAt": "2026-09-15T19:51:13.097+00:00",
    "resolvedAt": "2026-09-15T19:51:13.08+00:00",
    "provider": {
      "slug": "pantheon",
      "name": "Pantheon"
    },
    "affectedServices": [
      {
        "slug": "pantheon-certificates",
        "name": "Certificate Provisioning"
      },
      {
        "slug": "pantheon-sites",
        "name": "Customer Sites"
      },
      {
        "slug": "pantheon-dashboard",
        "name": "Dashboard"
      },
      {
        "slug": "pantheon-workflows",
        "name": "Deploys & Workflows"
      },
      {
        "slug": "pantheon-cdn",
        "name": "Global CDN"
      }
    ],
    "links": {
      "html": "/incidents/pantheon-security-advisory-unauthorized-access-via-credential-stuffing-2026-09-11",
      "api": "/api/v1/incidents/pantheon-security-advisory-unauthorized-access-via-credential-stuffing-2026-09-11",
      "providerHtml": "/providers/pantheon",
      "alerts": "https://outagedeck.com/account?stack=pantheon&utm_source=api&utm_medium=response&utm_campaign=api_alerts&utm_content=incident"
    },
    "impactSummary": "Pantheon reported a minor event for the affected tracked services.",
    "source": {
      "id": "source_pantheon_status",
      "kind": "official_api",
      "name": "Pantheon Operations Status",
      "checkedAt": "2026-10-27T15:20:12.947+00:00",
      "stale": false,
      "officialUrl": "https://status.pantheon.io",
      "statusPageUrl": "https://status.pantheon.io"
    },
    "updates": [
      {
        "id": "update_statuspage_pantheon_z6fjft9bxt34_rt4n7n241mj6",
        "status": "investigating",
        "body": "We are currently investigating reports of unauthorized access to a small number of Pantheon customer accounts.\nOur evidence suggests these accounts were accessed using credentials stolen from external third-party data breaches (unrelated to Pantheon). This technique, known as \"credential stuffing,\" relies on reused passwords.",
        "createdAt": "2026-09-12T04:13:15.433+00:00"
      },
      {
        "id": "update_statuspage_pantheon_z6fjft9bxt34_zp4lj3439k4t",
        "status": "investigating",
        "body": "We are continuing to investigate this issue.",
        "createdAt": "2026-09-12T04:16:05.365+00:00"
      },
      {
        "id": "update_statuspage_pantheon_z6fjft9bxt34_69p0g6l04lr1",
        "status": "investigating",
        "body": "Our team is still investigating the issue. The next update will be in 6 hours or when a new major update comes.",
        "createdAt": "2026-09-12T10:18:25.982+00:00"
      },
      {
        "id": "update_statuspage_pantheon_z6fjft9bxt34_qn9nntnhdk32",
        "status": "investigating",
        "body": "We are correcting our initial assessment. Our earlier update said the affected accounts were accessed with passwords stolen in third-party data breaches. Our evidence indicates that credentials were captured on a fraudulent copy of the Pantheon sign-in page. The look-alike page was promoted through paid search results and links, and it forwarded users to the real Pantheon Dashboard after capturing what they typed, so many affected users saw nothing unusual.\nWe have identified and reported one such site. Sites of this kind are usually replaced quickly. We are continuing to search for others and to work with the providers involved.\nPantheon's systems were not breached. Once inside an account, the unauthorized party used normal account functions: creating machine tokens, adding SSH keys, and on some affected sites, deploying code to production. We will be contacting affected account holders and site owners directly once we confirm the list of affected accounts, resetting credentials, and revoking tokens and keys on those accounts. If you are not contacted, we have no indication your account was accessed.\n\nHow to protect your account\nSign in only by typing https://dashboard.pantheon.io into your browser or using a bookmark you created. Do not sign in from a search result, a sponsored ad, or a link in an email or chat message, even one that appears to come from Pantheon. Before you type a password, check that the address bar shows dashboard.pantheon.io spelled exactly; look-alike pages differ by a letter or two.\nTurn on multi-factor authentication for your Pantheon account (Personal Settings, then Security). Instructions: https://docs.pantheon.io/release-notes/2026/04/mfa\nIf you have signed in from a search result or emailed link recently, change your password now, then review your account: remove SSH keys you do not recognize (https://docs.pantheon.io/ssh-keys), revoke machine tokens you did not create (https://docs.pantheon.io/machine-tokens), and check your site and workspace team lists for members you did not add.\nPantheon will never ask for your password by email, chat, or phone. Report suspicious sign-in pages or messages to abuse@pantheon.io. Our security practices and contacts are published at https://pantheon.io/security and https://trust.pantheon.io.",
        "createdAt": "2026-09-12T16:58:09.53+00:00"
      },
      {
        "id": "update_statuspage_pantheon_z6fjft9bxt34_b7rsx4ww7m3f",
        "status": "identified",
        "body": "We have identified the cause of this incident and are actively responding. Our evidence indicates the affected accounts were accessed using passwords captured on a fraudulent copy of the Pantheon login page, reached through sponsored search results and not through any compromise of Pantheon's own systems\n\nWe are securing the affected accounts, resetting credentials, and revoking access created by the unauthorized party. As part of this, you will receive a routine password-reset email. \n\nWe are also contacting affected account holders and site owners directly; those security notifications will come from helpdesk@pantheon.io and are genuine.",
        "createdAt": "2026-09-12T22:51:05.344+00:00"
      },
      {
        "id": "update_statuspage_pantheon_z6fjft9bxt34_j0hzt1pxvl06",
        "status": "monitoring",
        "body": "We have completed mitigation steps for the compromised accounts, including resetting passwords and revoking unauthorized access, machine tokens, and SSH keys.\n\nWe are continuing to notify affected account holders and site owners directly. Customers who are affected will receive specific guidance from Pantheon through our support channels.\n\nPantheon’s systems were not compromised. We will continue monitoring the situation and provide further updates as our review progresses.",
        "createdAt": "2026-09-13T16:26:51.988+00:00"
      },
      {
        "id": "update_statuspage_pantheon_z6fjft9bxt34_6tr2l8kv6p35",
        "status": "monitoring",
        "body": "We have no new developments to share. We're continuing to keep the affected accounts secure, including resetting passwords and revoking any unauthorized access, machine tokens, and SSH keys. \n\nPantheon's systems were not compromised. We're continuing to reach out to affected account holders and site owners directly with guidance on next steps.",
        "createdAt": "2026-09-14T07:02:44.803+00:00"
      },
      {
        "id": "update_statuspage_pantheon_z6fjft9bxt34_6tly1bfn66bx",
        "status": "monitoring",
        "body": "We have completed mitigation for this incident. All confirmed affected accounts have had passwords reset and unauthorized access, machine tokens, and SSH keys revoked. All confirmed affected account holders and site owners have been contacted directly.\n\nWe will continue monitoring the situation and share an update if anything changes.",
        "createdAt": "2026-09-15T01:01:39.137+00:00"
      },
      {
        "id": "update_statuspage_pantheon_z6fjft9bxt34_fpd47rdkn6vc",
        "status": "resolved",
        "body": "This incident has been resolved.",
        "createdAt": "2026-09-15T19:51:13.08+00:00"
      }
    ],
    "access": {
      "plan": "public",
      "keyed": false
    }
  }
}