Is Hoxhunt down?

We are investigating an issue in User Management that affects operations involving more than 1,000 users. CSV exports of more than 1,000 users contain only the first 1,000 rows. Bulk user actions using "Actions" -> "Set properties" applied to more than 1,000 users are only applied to 1,000 users. Operations on 1,000 users or fewer are not affected. As a workaround, please run exports and bulk actions in batches of 1,000 users or fewer, and check the results before relying on them. We will post another update as soon as we have more information, or within 60 minutes.

The issue affecting User Management has been resolved. From approximately 08:00 UTC on Friday 30 October until 12:30 UTC on Monday 2 November, CSV exports and bulk user actions that included more than 1,000 users were limited to the first 1,000 users. The full set of users is now returned and affected again. If you ran a CSV export or bulk user action (via "Actions" -> "Set properties" on the User Management page) on more than 1,000 users during this incident, the results may have been incomplete. Please re-run them to make sure all users are included. We apologise for the inconvenience.

Some customers are currently seeing a sudden drop in their Hoxhunt Security Score and related training metrics on the admin dashboard. This is caused by an incomplete data refresh in our reporting pipeline, not by any change in your users’ behaviour or training results. No data has been lost, and the underlying training and reporting activity is intact. We have identified the cause and are re-running the affected reporting jobs. We expect the scores to be corrected this afternoon (EET). Scores shown for October will be restored to their correct values once the re-run completes; no action is needed on your side. We will update this page when the fix is confirmed.

The reporting jobs have completed and Human Risk Score values on the admin dashboard are now correct, including the values for October. We apologize for the confusion this caused and have added safeguards to our pipeline to prevent a recurrence.

We are investigating an issue affecting manual Search & Destroy actions in Incident Orchestration (response.hoxhunt.com), including creating new searches, deleting, and reverting emails. Automatic Search & Destroy actions are not affected. A fix has been developed and we are working to deploy it as quickly as possible. We will post another update once it is released.

This incident has now been resolved. All manual Search & Destroy actions, including searching, deleting and reverting, can now be performed again. Apologies for any inconvenience caused.

Since 22 September 19:09 CEST, messages sent through the Hoxhunt Microsoft Teams app are not being delivered. This affects training notifications and reminders, course reminders (including manager reminders), Trending Campaign alerts, and other messages Hoxhunt sends to users via Teams. Email delivery, Slack notifications, the Hoxhunt add-in for Outlook and Gmail, the admin portal and all reporting are not affected. We have identified the cause as an expired credential used by the Hoxhunt Teams app and are replacing it now. No action is needed from your side. We will update this page once delivery is restored.

We are continuing to work on a fix for this issue.

This incident is resolved. The expired credential used by the Hoxhunt Microsoft Teams app was replaced and Teams message delivery was restored at 09:20 CEST on 24 September. Between 22 September 19:09 CEST and 24 September 09:20 CEST, messages sent through the Hoxhunt Teams app were not delivered. This affected training notifications and reminders, course reminders (including manager reminders), Trending Campaign alerts and other messages Hoxhunt sends to users via Teams. Email, Slack, the Outlook and Gmail add-ins, the admin portal and reporting were not affected at any point. Notifications that could not be delivered during this period are not re-sent. Scheduled reminders have resumed on their normal schedule. We are adding expiry monitoring for this credential so that it is renewed well before it lapses. We apologise for the disruption.

We are currently investigating an issue causing delays in processing reported threats submitted by users. Reports are being received but not yet fully updated/enriched. We'll post updates as we learn more.

A fix has been implemented and we are monitoring the results.

This incident has been resolved. Reported threats are being processed normally again.