RSA ID Plus Service Incident (EMEA Region)

**Initial Root Cause Analysis**

**Summary**

On September 14, 2026, between approximately 06:20 UTC and 07:20 UTC, a subset of customers hosted in the RSA ID Plus EU2 production environment experienced authentication service degradation.

During the incident, authentication requests were intermittently unable to complete successfully. Across the affected authentication traffic, RSA estimates that approximately 15–20% of authentication attempts succeeded during the period of degradation. The level of impact varied by customer and authentication flow.

**What Happened**

Beginning at approximately 06:20 UTC, authentication processing latency and failure rates increased within the EU2 environment. The degradation affected portions of the request-processing path used by the authentication service and resulted in elevated error rates for a subset of customers in the EMEA region.

RSA engineering teams investigated the affected services and supporting infrastructure. Service performance improved as processing conditions stabilized, and authentication success rates returned to expected levels by approximately 07:20 UTC.

**Root Cause**

RSA has not yet identified a definitive root cause for this incident. Our investigation remains active and includes a review of application telemetry, authentication traffic patterns, request-processing behavior, and supporting infrastructure within the EU2 environment.

Initial analysis shows that authentication demand, request retries, processing latency, and resource utilization increased during the incident window. RSA is working to establish the relationship among these conditions, determine the sequence of events, and identify which conditions initiated or amplified the degradation. These findings remain preliminary and should not be interpreted as a final determination of root cause.

**Resolution**

Service performance recovered as the affected processing environment stabilized. RSA engineering teams confirmed that authentication latency, error rates, and service throughput had returned to expected levels and continued monitoring the EU2 environment following recovery.

RSA did not initiate regional failover during the incident because the environment remained partially operational and did not meet the criteria for an automated regional transition. RSA maintains regional failover capabilities to support service continuity during regional service events. In this case, preliminary analysis indicated that the conditions contributing to the degradation would likely have followed authentication traffic to the recovery region. Based on those conditions, RSA did not expect a regional transition to resolve the degradation and determined that it could reproduce the same behavior in the recovery environment.

RSA has not identified any customer configuration changes required in response to this incident.

**Actions and Ongoing Investigation**

RSA is continuing a detailed investigation and is taking steps to reduce the likelihood and potential impact of similar events. This work includes:

* Analyzing authentication traffic, retry patterns, and service dependencies to establish the complete sequence of events.

* Reviewing request-handling and capacity controls to prevent elevated activity associated with a single customer or connection path from affecting other customers in the environment.

* Evaluating retry and timeout behavior to reduce amplification during periods of service congestion.

* Reviewing load distribution across application components and investigating the uneven error distribution observed during the incident.

* Enhancing service telemetry and alerting for processing latency, resource saturation, abnormal retry behavior, and dependencies supporting customer-connected components.

* Evaluating additional capacity and resiliency measures for authentication processing within the EU2 environment.

RSA will provide an updated RCA within 10 business days of the incident. If the investigation remains open at that time, RSA will provide the findings available to date, the status of remaining investigative work, and any additional corrective actions identified.

We experienced a service degradation affecting a subset of customers hosted in our EMEA region on the EU Pod 2 deployment. Some customers may have experienced intermittent issues accessing the service. This issue is no longer ongoing.

We will post a root cause analysis as soon as it is available.