Is Pantheon down?

We are currently investigating reports of unauthorized access to a small number of Pantheon customer accounts. Our evidence suggests these accounts were accessed using credentials stolen from external third-party data breaches (unrelated to Pantheon). This technique, known as "credential stuffing," relies on reused passwords.

We are continuing to investigate this issue.

Our team is still investigating the issue. The next update will be in 6 hours or when a new major update comes.

We are correcting our initial assessment. Our earlier update said the affected accounts were accessed with passwords stolen in third-party data breaches. Our investigation shows our evidence indicates that credentials were captured on a fraudulent copy of the Pantheon sign-in page. The look-alike page was promoted through paid search results and links, and it forwarded users to the real Pantheon Dashboard after capturing what they typed, so many affected users saw nothing unusual. We have identified and reported one such site. Sites of this kind are usually replaced quickly. We are continuing to search for others and to work with the providers involved. Pantheon's systems were not breached. Once inside an account, the unauthorized party used normal account functions: creating machine tokens, adding SSH keys, and on some affected sites, deploying code to production. We will be contacting affected account holders and site owners directly once we confirm the list of affected accounts, resetting credentials, and revoking tokens and keys on those accounts. If you are not contacted, we have no indication your account was accessed. How to protect your account Sign in only by typing https://dashboard.pantheon.io into your browser or using a bookmark you created. Do not sign in from a search result, a sponsored ad, or a link in an email or chat message, even one that appears to come from Pantheon. Before you type a password, check that the address bar shows dashboard.pantheon.io spelled exactly; look-alike pages differ by a letter or two. Turn on multi-factor authentication for your Pantheon account (Personal Settings, then Security). Instructions: https://docs.pantheon.io/release-notes/2026/04/mfa If you have signed in from a search result or emailed link recently, change your password now, then review your account: remove SSH keys you do not recognize (https://docs.pantheon.io/ssh-keys), revoke machine tokens you did not create (https://docs.pantheon.io/machine-tokens), and check your site and workspace team lists for members you did not add. Pantheon will never ask for your password by email, chat, or phone. Report suspicious sign-in pages or messages to [email protected]. Our security practices and contacts are published at https://pantheon.io/security and https://trust.pantheon.io.

We have identified the cause of this incident and are actively responding. Our evidence indicates the affected accounts were accessed using passwords captured on a fraudulent copy of the Pantheon login page, reached through sponsored search results and not through any compromise of Pantheon's own systems We are securing the affected accounts, resetting credentials, and revoking access created by the unauthorized party. As part of this, you will receive a routine password-reset email. We are also contacting affected account holders and site owners directly; those security notifications will come from [email protected] and are genuine.

We have completed mitigation steps for the compromised accounts, including resetting passwords and revoking unauthorized access, machine tokens, and SSH keys. We are continuing to notify affected account holders and site owners directly. Customers who are affected will receive specific guidance from Pantheon through our support channels. Pantheon’s systems were not compromised. We will continue monitoring the situation and provide further updates as our review progresses.

We have no new developments to share. We're continuing to keep the affected accounts secure, including resetting passwords and revoking any unauthorized access, machine tokens, and SSH keys. Pantheon's systems were not compromised. We're continuing to reach out to affected account holders and site owners directly with guidance on next steps.

We have completed mitigation for this incident. All confirmed affected accounts have had passwords reset and unauthorized access, machine tokens, and SSH keys revoked. All confirmed affected account holders and site owners have been contacted directly. We will continue monitoring the situation and share an update if anything changes.

This incident has been resolved.

We are currently investigating an issue causing 504 errors on a subset of hosted customer sites. Some visitors may experience timeouts or failed page loads. Our team is actively working to identify the root cause. We will post an update as soon as we have more information. If you need immediate assistance: General concerns: Open a chat with our support bot and request to open a ticket for urgent cases. If the Dashboard is inaccessible: Email us directly at [email protected]. We will provide another update within 30–60 minutes, or as soon as new information becomes available. Thank you for your patience.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

Our Engineering team is currently investigating reports of degraded performance affecting the Dashboard interface. A subset of users may experience slow page loading times or intermittent issues opening site environments. Live hosted sites and environment uptime remain fully operational and unaffected. We are actively working to identify the root cause and restore normal performance as quickly as possible. Need Immediate Assistance? • General concerns: Open a chat with our support bot and request to open a ticket for urgent cases. • If the Dashboard is inaccessible: Email us directly at [email protected]. We will provide another update within 30–60 minutes, or as soon as new information becomes available. Thank you for your patience.

Our team is continuing its investigation into the degraded performance affecting the Dashboard interface. In addition, recent telemetry shows that a small subset of hosted sites is also experiencing performance degradation. We are actively working to mitigate the impact and restore full functionality.

Our investigation indicates that accessibility and performance issues are affecting a subset of hosted sites in addition to the Dashboard. We are treating this as a critical incident, and our engineering team is actively working to isolate the cause and restore service. If you require immediate assistance and the Dashboard is inaccessible, please email us directly at [email protected]. Thank you for your patience while we work to resolve this.

We have identified the root cause of the issue and are actively applying a fix. Telemetry is showing performance improvements across the Dashboard and affected sites. If the Dashboard remains inaccessible and you require immediate assistance, please email us directly at [email protected]. We will share another update shortly as services continue to recover.

Telemetry graphs continue to show steady performance recovery across all impacted services. We are adjusting component statuses to Degraded Performance and actively monitoring systems as they normalize. For urgent assistance, email [email protected].

Most products have recovered and performance is normalizing. Our engineering team is actively validating a few remaining product impacts. For urgent assistance or Dashboard access issues, please contact [email protected].

Our engineering team continues working to resolve the issue across the remaining impacted components. Overall performance across most services continues to improve, and we are actively working toward full recovery. If you are experiencing persistent issues or cannot access the Dashboard, please email us directly at [email protected].

Following remediation efforts, telemetry graphs show that all platform components and hosted sites have recovered to normal operational levels. We have shifted the incident status to Monitoring while our engineering team closely tracks system health and performance. If you encounter persistent issues or the Dashboard remains inaccessible, please reach out directly to [email protected].

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

We are investigating reports of degraded performance affecting the Dashboard interface. A subset of users may experience slow loading times or intermittent issues loading site environments. Live hosted sites and environment uptime are fully operational and unaffected. Our Engineering team is actively working to identify the root cause and restore normal functionality. Need Immediate Assistance? General concerns: Submit a support ticket or reach out via Live Chat. If the Dashboard is inaccessible: Contact us directly at [email protected]. We will provide another update within 30–60 minutes, or as soon as new information becomes available.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

We are currently investigating degraded performance or failures in certain platform workflows, such as site creation. This may affect your ability to create new sites. Our engineers are actively triaging the issue and working to implement a fix. We’ll post progress updates regularly on this page. We recommend waiting on creation of sites until the issue is resolved.

We are continuing to investigate this issue.

The issue has been identified and a fix is being implemented.

We are continuing to work on a fix for this issue.

We are continuing to work on a fix for this issue.

We are continuing to work on a fix for this issue.

We are continuing to work on a fix for this issue.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.