[Investigating][Severity: Major][Credential abuse]

STANDS: break-in at the admin screen of the Onboarding UI tool; client settings were taken and some changed

A third party got into the admin screen of the Onboarding UI tool and used admin rights to take and change settings of several clients. Contact names and emails were likely seen.

Disclosed

2026-10-16

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2026-10-14
Unauthorized access to the admin screen was confirmed. The third party had used admin rights to take settings from several clients' environments and change some of them. [1]
2026-10-16
First report. [1]

Impact

Operations that took some report data [1]
The AI chat feature's connection details were taken and its settings changed [1]
Names, email addresses and permissions of contacts registered in the admin screen were likely viewed; whether they were actually taken is not known. [1]

The guide feature shown to end users was not affected and keeps running. [1]

Response

The admin screen and AI features were paused, credentials changed and access restricted. There is no restart date yet. Affected clients are being briefed one by one. [1]