SFTP Login Failures for ed25519 key-based authentication only in all regions

Update timeline

1. resolved Jun 05, 2026, 05:51 PM UTC

   We resolved an incident on the Files.com platform that caused SFTP logins using ed25519 SSH keys for authentication to fail. This incident impacted a small portion of users on our platform. Only SFTP, and only key-based logins using ed25519 keys were impacted by this incident. No other services or authentication types were effected. This incident occurred between from 17:13 UTC on 6/4/26 and 15:12 UTC 6/5/26, and was fully resolved by a code deploy. We will provide a detailed postmortem and RCA for this incident.

2. postmortem Jun 08, 2026, 03:09 PM UTC

   Between 17:13 UTC on June 4, 2026 and 15:12 UTC on June 5, 2026, [Files.com](http://Files.com) customers using SFTP with ed25519 SSH key-based authentication experienced authentication failures. This incident was limited to SFTP connections using ed25519 public keys. All other authentication methods — including password-based SFTP authentication, RSA key authentication, and all other [Files.com](http://Files.com) protocols and services — continued to operate normally throughout this period. We failed to catch this regression before it reached production. A deployment to our SFTP server infrastructure introduced a change intended to improve host key handling, but it inadvertently broke the authentication path for clients using ed25519 public keys. Our automated test suite covered RSA key authentication but did not include tests for ed25519 keys, and we failed to manually verify ed25519 authentication during pre-deploy validation. This was a gap in our testing discipline that we are correcting. We also failed to detect this failure through our own monitoring. An existing issue in our internal compliance logging pipeline caused log events from the affected authentication sessions to be silently dropped rather than stored. Because these failed login attempts were not surfacing in our monitoring systems, we did not detect the incident internally — we learned of it from customer reports beginning on the morning of June 5, 2026. We are adding alerting on this pipeline to ensure failures are surfaced immediately. We resolved the incident at 15:12 UTC on June 5, 2026 by rolling back the FPS deployment and restarting all SFTP servers across all regions. We confirmed the fix across affected customer accounts in all regions. We are also addressing a process gap: our status page update was posted more than 20 hours after incident onset, which is unacceptable. We are reconciling internal process documentation to ensure status updates are posted promptly in future incidents. The root cause of this incident was [Files.com](http://Files.com)'s insufficient test coverage for a change that was deployed to production, combined with a monitoring gap that prevented early detection. We are correcting both. Our customers trust us with their most sensitive and time-critical workflows, and we understand the disruption this caused. We are sorry. Our entire engineering team is committed to the improvements needed to prevent this type of incident from occurring again. If you need additional assistance or continue to experience issues, please contact our Customer Support team.