Repeated confirmation emails after reporting a phishing simulation

Update timeline

1. investigating Oct 15, 2026, 09:37 AM UTC

   Since October 14, around 08:00 UTC, some users who report a phishing simulation receive the confirmation email ("Spot on!") several times. A third-party email delivery service sends the same report to our platform multiple times, and each copy triggers a confirmation email. Reports are recorded correctly, and users don't need to do anything. The repeated emails are harmless and can be ignored. We are deploying a fix so that only one confirmation email is sent per report. We are also working with our email delivery provider on the root cause. We will post an update once the fix is live.

2. identified Oct 15, 2026, 09:43 AM UTC

   We have prepared a fix that sends only one confirmation email per reported simulation, even when the same report reaches our platform several times. It is in review and will be deployed shortly. Until the fix is live, some users may still receive repeated confirmation emails after reporting a simulation. Reports are recorded correctly, and the repeated emails can be ignored. We are also working with our email delivery provider on the root cause. We will post an update once the fix is deployed.

3. monitoring Oct 15, 2026, 10:24 AM UTC

   Since October 14 around 08:00 UTC, some users who reported a phishing simulation received the confirmation email ("Spot on!") several times, sometimes every 20 to 25 minutes for several hours. Our email provider delivered the same report to our platform many times, and we sent a confirmation for each delivery. We have deployed a fix: a simulation now triggers one confirmation email only, however many times the report reaches us. Reports already received are recorded correctly, and simulation results and dashboards are not affected. Users who reported a real (non-simulated) email may still receive the acknowledgement more than once while we finish a second fix. We are working with our email provider on the underlying cause and are monitoring the situation.

4. resolved Oct 15, 2026, 12:17 PM UTC

   Resolved – Since October 14 around 08:00 UTC, some users who reported a phishing simulation received the confirmation email ("Spot on!") several times. Our email provider delivered the same report to our platform many times, and we sent a confirmation for each delivery. We deployed a fix on October 15 at 10:17 UTC: each reported simulation now triggers a single confirmation email, however many times the report reaches us. We have monitored the platform since then and observed no further repeated confirmations. Simulation results were not affected. We are following up with our email provider on the underlying cause and will add further safeguards against repeated deliveries. We apologize for the inconvenience.