Incident period: 6–18 July 2026 · Published: 21 July 2026

Final Incident Report — Unauthorized access to stored integration credentials

Summary
Between 6 and 18 July 2026, an unauthorized actor gained access to an internal, non‑customer‑facing environment that had read access to a restricted, read-only replica containing a limited subset of production data. Based on our completed investigation, the actor executed read queries that resulted in access to certain information stored within that environment, including certain third‑party ESP/export credentials that customers had stored in Stripo for their integrations, together with certain account records. Upon identifying the activity, we isolated and decommissioned the environment involved, implemented remediation measures, and completed our investigation into the incident.

The incident was reported solely through a client request and could not have been detected through our standard monitoring.

What data was affected
Based on our completed investigation, the information identified as having been accessed included certain third‑party ESP/export credentials that customers had saved to connect their integrations, together with certain associated account records.

Account authentication data. Stripo passwords are stored hashed and salted — never in plain text, in line with security best practices, so they were not exposed in a usable form. Because a determined attacker could, in theory, attempt to crack salted hashes over time, we did not take chances: we proactively reset every Stripo password and invalidated all active sessions, even though there is no indication that the hashes can be practically recovered. Each user simply sets a new password at their next sign‑in.

What we have done
1. Contained the incident by cutting off and decommissioning the internal environment involved.
2. Extended encryption at rest to all stored ESP/export credentials, including those that were not already encrypted (keys held in a managed AWS KMS).
3. Stopped returning credentials to the browser when integration screens are opened.
4. Reviewed application logging and removed credential values from the limited scenarios in which they could appear. While our investigation did not identify evidence that application logs formed part of the attack path, we nevertheless implemented this additional safeguard as part of our broader remediation efforts.
5. Purged old/inactive credentials retained after they were no longer in use.
6. For Klavio, HubSpot, Zoho, Pardot, AWeber, Outlook Web, and Pega, we automatically revoked all authorization tokens.
7. Conducted a full review across our infrastructure perimeter: audited all security groups and access paths to system nodes, rotated the passwords for all databases, restricted the read‑only replica to internal‑only access, and reviewed access held by internal services and staff, tightening it under least‑privilege principles.
8. Proactively reset all user passwords and invalidated sessions.
9. Added monitoring and alerting for authentication to internal tools, external database connections, and bulk reads of sensitive tables.

We operate under recognized security and data‑protection standards, including our SOC 2 program. As part of our ongoing security program, we continue to strengthen our technical and organizational controls based on the findings of this investigation.

Who was not affected
Customers who exported only to file formats (HTML, AMP HTML, PDF, EML, image, etc.) never stored any credentials with us and are not affected. Credentials were also not accessed for the following providers: CleverTap, Customer.io, Follow Up Boss, Google Cloud, MailerCloud, MailerLite, Mailtrap, Make, Mindbaz, n8n, Netcore, OneSignal, Optimove, Postup, Pubrio, Rapidmail, Reteno, Selzy, Sender.net, Ticketor, Unione, Insider, Voizee, WhatCounts, Yespo. Plugin and self‑hosted deployments were not affected — the environment and replica involved are part of Stripo Cloud infrastructure, not the self‑hosted product or the Stripo plugin.

Long‑inactive accounts. Under our data‑retention policy and in line with our GDPR obligations, inactive customer accounts and their personal data are routinely deleted, so information belonging to long‑inactive customers was not present in this environment and could not have been exposed.

Payment data
Based on our investigation, no full payment card numbers (PANs) or CVV codes were identified as having been accessed. Card payments are processed by our payment providers (Stripe and PayPal), and Stripo does not store full payment card numbers or CVV codes.

Working with our ESP partners
Because these are third‑party credentials, we are proactively contacting the ESP providers involved, in the spirit of partnership and to protect our mutual customers, so affected credentials can be revoked on their side as an additional safeguard.

What we recommend our customers do
1. If your provider is not in the “Who was not affected” section above and you haven't already: rotate the ESP credentials connected to your Stripo account — revoke the old key at your provider, generate a new one, and update it in Stripo (Project Settings → Integrations). For OAuth‑based integrations, revoke Stripo's authorization at your provider and reconnect.
2. Review your ESP/CRM activity from early July onward — sign‑ins, contact‑list changes, and any campaigns, sends, or exports you don't recognize. Rotating a key stops future use but doesn't undo activity that already occurred.
3. Your Stripo password has already been reset — set a new one at your next sign‑in.

Closing
We sincerely regret that this incident occurred. We've contacted affected customers directly and remain available to answer follow‑up questions on request. Contact: security@stripo.email.

Jul 20, 2026 - 18:15 UTC

What we've fixed

Following our initial communication, we have implemented a number of additional security enhancements:
1. Credential protection audit. We reviewed how credentials are stored across our systems and implemented additional encryption for credential data where enhanced protection was identified as appropriate.
2. Implemented additional browser-side protections to address an identified browser-related exposure scenario. Stored credentials are no longer sent back to the browser when the integrations screen is opened. This, combined with the storage enhancement above, significantly reduces potential exposure risks associated with credential handling.
3. Completed a full logging audit. We reviewed our logging systems end-to-end and updated our logging configuration to prevent credential values from being recorded in application logs.
4. Cleaning up stale data. We deleted old ESP connections that had been kept after they stopped being used, and we're in the process of removing old, unused keys still on file.

Based on our investigation to date, we have not identified any indication of impact on the Stripo Plugin. Stripo does not store customers' financial or payment information. Accordingly, based on our investigation to date, we have not identified any impact on financial or payment data maintained by Stripo. Based on the information currently available, we have not identified any impact on our primary production systems. The activity identified to date appears to have been associated with a backup environment. We've implemented additional security measures for that environment and are continuing to assess whether there is any broader impact as part of our ongoing investigation.

Compliance certifications

We maintain an independently audited security program, including SOC 2 and ISO certifications. As part of this investigation, we identified opportunities to further strengthen certain technical controls related to the handling of export credentials.

We have implemented additional safeguards addressing the matters identified during our investigation. We are also incorporating the findings from this investigation into our security program, risk assessment processes, technical controls, and future audit activities. These findings have informed additional technical safeguards and will continue to be incorporated into our security controls and audit program. Security certifications demonstrate that an organization's security program has been independently assessed against recognized standards. Like any security framework, they support continuous improvement as new risks and implementation considerations are identified.

Ongoing investigation

Our investigation remains ongoing. As part of this work, we continue to review access activity relating to the database instances where the relevant data is stored. Should we identify confirmed findings that are material to affected customers, we will communicate them without undue delay.

Stripo Security Incident
How this started

We received two customer reports regarding unusual activity associated with ESP accounts. While an individual report could reasonably have been attributed to a variety of causes, including configuration issues, legacy integrations, or provider-specific factors, the second report involved a different ESP provider and exhibited similar characteristics. At that point, we determined that the observed pattern warranted a comprehensive security review and initiated a broader investigation.

Current status

As we identified accounts with stored ESP credentials, we reached out asking those customers to rotate their keys as a priority. This was not a single, complete pass: as our investigation continued, we identified additional accounts that required the same notification, and we've been contacting them as they're confirmed.

If you have ESP credentials connected to Stripo and haven't rotated them yet:
1. Revoke the old key there; generating a new key doesn't automatically disable the old one.
2. Generate a new key in your ESP account.
3. Update the new key in Stripo under Project Settings → Integrations.
4. Review your ESP or CRM account's recent activity: login history, contact list changes, and any campaigns or sends you don't recognize.

One reminder while all this is underway: we will never ask you to send a key, token, or password by email or in a support chat.

Ongoing investigation

Our investigation is continuing. Should we identify any confirmed findings that are material to affected customers, we will communicate them without undue delay.