Expel experienced a critical incident on August 30, 2026 affecting Email and Ticketing systems (via email, such as Jira) and 1 more component, lasting 10h 10m. The incident has been resolved; the full update timeline is below.
Affected components
Update timeline
- identified Aug 30, 2026, 09:43 AM UTC
Emails from Workbench are delayed since 12am UTC. We have identified the root cause and are working on a remediation. Phishing outcome responses, User Email notifications, and Org-Level Email Ticketing notifications are delayed since 12am UTC. SOC operations and alert ingestion are not affected. We will provide another update by 12:30pm UTC
- identified Aug 30, 2026, 11:10 AM UTC
We have identified the cause are continuing to work on remediation. We have also confirmed that due to this issue, when someone submits a suspected phishing email, the email will not reach Workbench for review. Next update at 1pm UTC.
- identified Aug 30, 2026, 12:58 PM UTC
We are continuing to work on remediation. MDR services are unaffected. Alert ingestion, detection, and investigation are operating normally. Slack, Microsoft Teams, PagerDuty, Opsgenie, and Service Now notifications are still being delivered. Email delivery from Workbench remains unavailable. No action is required at this time; we will confirm resubmission steps for phishing submissions once service is restored. Next update: Monday, 31 August at 13:00 UTC (9:00 AM ET)
- monitoring Aug 30, 2026, 06:14 PM UTC
Email delivery from Workbench is now working and emails in the queue are being replayed. An update will be posted once the replay is complete.
- resolved Aug 30, 2026, 07:53 PM UTC
This issue is resolved. Email delivery from Workbench has been restored, and phishing email submissions are processing normally. Suspected phishing emails submitted during this time were not received by Expel and could not be processed. Please ask your users to resubmit anything they reported during this period. Notification emails generated during this time have been delivered. Some may arrive later than the timestamp they were originally generated.