Is Phrase down?

Attackers signed in to existing Phrase user accounts with correct usernames and passwords. Once inside, the attackers mainly tried to misuse Phrase’s email notifications to send phishing messages to third parties. The activity came in several waves between late August and October 2026, most likely from more than one group of attackers. Phrase’s own systems were not breached: the attackers signed in with valid usernames and passwords that had been compromised outside of Phrase.

# Post-Mortem: Security Incident Affecting Phrase User Accounts – Late August–October 2026 ## Introduction We would like to give you a transparent account of a security incident in which unauthorized third parties gained access to Phrase user accounts between late August and October 2026. Phrase's own systems were not breached: the attackers signed in with valid usernames and passwords that had been compromised outside of Phrase. This report explains what happened, what we have done, how our countermeasures affected your daily work, and what you can do to protect your organization. ### What happened Attackers signed in to existing Phrase user accounts with correct usernames and passwords. In every confirmed case, the first sign-in attempt succeeded: there were no failed attempts beforehand and no two-factor challenge. This shows the credentials had already been obtained elsewhere, through phishing of the user's email or through passwords reused across several services \("credential stuffing"\). Once inside, the attackers mainly tried to misuse Phrase's email notifications to send phishing messages to third parties. They used two features for this: * **User invitations**, sent from compromised accounts to large lists of external email addresses. * **Custom email templates** in Phrase TMS, where they changed the recipients \(cc/bcc\) and inserted links to phishing sites, then triggered notifications at high volume. In several organizations, the attackers also created additional user accounts or organizations to keep access after a password change. Accessing customer content did not appear to be the attackers' interest; their focus was on sending emails and keeping access. Every affected organization has already been contacted by us. The activity came in several waves between late August and October 2026, most likely from more than one group of attackers. ### What did not happen * We found no evidence that Phrase's own systems or infrastructure were breached. The passwords used were not taken from Phrase. We store passwords only as salted hashes, a one-way form that no-one at Phrase can read or turn back into the password. We can only invalidate a password and trigger a password reset. * We found no evidence that the credentials of our email delivery service were leaked. As a precaution, we rotated them anyway. * Accounts protected by Single Sign-On \(SSO\) or two-factor authentication \(2FA\) were not compromised by these methods. * In the large majority of affected accounts, the attackers only looked at overview pages, such as project and job lists, before sending emails or being locked out. They did not open, change or download content. ## Timeline All dates are in 2026. * **Late August** – First reports that emails sent through Phrase were being used for phishing. * **Early September** – Attackers sent phishing invitations from compromised user accounts. * **September 11** – An unrelated alert about a stalled email queue led us to the compromised accounts. We blocked them, closed organizations created by the attackers and notified affected customers. * **September 14** – A second wave misused the recipient fields of custom email templates to send phishing emails at high volume. We closed this gap the same night. * **September 15** – We enforced a password reset for all users in affected organizations. * **September 16–18** – Deeper analysis found further affected organizations. We introduced hourly limits for emails per user and per organization and enabled a filter that blocks phishing-style emails. * **September 18–21** – A new wave of credential stuffing. Our new automated intrusion detection caught it. We disabled affected accounts and ended their active sessions. * **September 25–27** – Attackers found a new way to insert links into email templates. We switched off the creation and editing of custom email templates by default. * **September 29** – No new confirmed intrusions. Previously disabled accounts could be re-enabled on request. * **October** – Two-factor enforcement available for all organizations. ## Root Cause The incident had two causes that together made the attacks possible. 1. **Sign-in with username and password only.** Accounts without SSO or 2FA can be used by anyone who knows the password. Passwords obtained through phishing or reused from other services were enough to sign in. 2. **Email features that could be misused.** Custom email templates and invitations allowed a signed-in user to choose recipients and content freely. Our limits on email volume were set high to support legitimate high-volume customers. This made compromised accounts attractive for sending phishing in Phrase's name. In addition, our detection relied on indirect signals at first. It took an unrelated operational alert to uncover the first compromised accounts, and our activity logs did not yet hold all the detail needed for a fast investigation. ## Actions to Prevent Recurrence ### What we have done **Containment** * Disabled all compromised accounts, ended their sessions and revoked access tokens created by the attackers. * Removed user accounts and organizations the attackers had created. * Enforced password resets for all users in affected organizations. ‌ **Closing the attack paths** * Limited the number of cc/bcc recipients in email templates and blocked external links in templates by default. * Switched off the creation and editing of custom email templates by default. Existing templates keep working; editing is enabled on request. * Introduced hourly limits for emails sent per user and per organization, and tighter limits on sign-in attempts. * Enabled a filter that blocks phishing-style emails. * Prioritized our regular security scanning of the sign-in and translation management applications, resolving many findings with the most critical first. ‌ **Detection and investigation** * Introduced automated intrusion detection that watches for the patterns seen in this incident around the clock and raises an alert immediately. * Added extended monitoring for unusual email volumes. * Extended our activity logging, so we can reconstruct account activity faster and in more detail. ‌ **Stronger sign-in** * Organizations can now enforce 2FA for all of their users, in addition to enforcing SSO. * We recommend service accounts for integrations and automation, instead of personal usernames and passwords. * We have strengthened our central protection against malicious traffic, including stricter rate limits. * We now check passwords against lists of weak passwords and passwords exposed in known data breaches elsewhere. ### How our countermeasures affected customers Several of our protective measures disrupted legitimate work, and we want to be transparent about what happened, why it happened and what we are doing about it. * **Password resets** were enforced for whole organizations, not only for the compromised users. We chose this because we could not rule out further compromised accounts that had not been used yet. Some technical users, such as integrations signing in with a personal password, lost access until the password was updated. * **Tighter sign-in limits** affected integrations and automated workflows that sign in with a username and password at high frequency. On our side, these look the same as an attack, and this sign-in method was the attack path we had to close. * **Email limits and template restrictions** affected customers with high email volumes or templates containing links. ‌ These were emergency changes made under active attack. They were coordinated between our engineering, security and support teams, but not every affected customer was informed in advance. We will notify customers directly and promptly when an emergency security change can affect their workflows, and keep our customer-facing teams informed so they can help. Planned changes, including changes to sign-in methods and rate limits, are announced in advance. ### What you can do * **Enforce SSO or 2FA** for all users in your organization. This is the most effective protection against this type of attack. * **Move integrations to service accounts** instead of personal usernames and passwords. Service accounts are not affected by sign-in limits for users. * **Use unique passwords.** If a user's Phrase password is also used elsewhere, change it in both places. * **Review your users and access tokens.** Look for users, organizations or tokens you do not recognize, especially with owner or admin rights, and remove them. * **Be cautious with unexpected emails**, even when they appear to come from Phrase. Verify unusual requests for credentials or payments through a contact you already know. * **Report anything suspicious** to our Support team rather than replying to the message. We take the security of your data and your trust in Phrase seriously, and we apologize for the disruption this incident caused. We continue to monitor our platform closely and will inform you if we learn anything new that affects your organization. If you have questions, please contact your Customer Success Manager or our Support team.

We are currently investigating an issue affecting the Style Guides landing page in our EU region. Customers may experience difficulty accessing Style Guides, Content Groups and Phrase Ecosystem pages within Phrase TMS. Our team is actively working to identify the root cause and restore full functionality as quickly as possible.

The issue affecting the Style Guides landing page in our EU region has been resolved. Access to Style Guides, Content Groups, and Phrase Ecosystem pages within Phrase TMS has been restored. We will continue to monitor the situation and implement further improvements to prevent recurrence.

We are currently investigating an issue affecting Phrase TMS services in the EU region, including the CAT editor, API, project management, translation memory, and related components. Users may experience errors or be unable to access these services at this time. Our team is actively working to identify the cause and restore full functionality as quickly as possible.

Services have stabilized and Phrase TMS in the EU region is now operating normally. We keep monitoring the situation.

This incident has been resolved.

Some users might be experiencing issues with accessing Phrase TMS.

The issue has been identified and a fix is being implemented.

The fix has been implemented, and we are monitoring the results. Phrase TMS can now be accessed with no further issues.

This incident has been resolved.

## Introduction We would like to share details about an incident that affected access to Phrase TMS on September 23, 2026. Between 9:02 AM and 11:27 AM CEST, users opening Phrase TMS from Phrase Platform could not complete the sign-in. They were either caught in a redirect loop or returned to the Phrase TMS login page with a sign-in error. Users who already had an active Phrase TMS session were not affected, and no customer data was lost or modified. Signing in to Phrase Platform itself kept working throughout the incident, both with a password and with single sign-on. So did signing in with a password directly on the Phrase TMS login page. This post-mortem explains what happened, how it was resolved, and what we are doing to prevent it from happening again. ## Timeline * **Sep 23, 2026 at 9:02 AM CEST** – An update to the Phrase TMS web application went live in production. It included a security improvement to how the sign-in flow handles redirects after login. From this point, users opening Phrase TMS from Phrase Platform could not complete sign-in. Shorty after, the issues was investigated internally. * **Sep 23, 2026 at 10:59 AM CEST** – The update from 9:02 AM CEST was identified as the cause, and we began preparing a rollback. * **Sep 23, 2026 at 11:13 AM CEST** – The rollback was verified in our test environment, and deployment to production started. * **Sep 23, 2026 at 11:27 AM CEST** – The rollback was live in all production regions. Customer-facing impact ended. * **Sep 23, 2026 at 11:28 AM CEST** – We confirmed that signing in to Phrase TMS from Phrase Platform worked again. * **Sep 23, 2026 at 12:04 PM CEST** – The incident was marked as resolved on our status page. ## Root Cause The incident was caused by a security improvement to the Phrase TMS web application. Its goal was to make sure users are only sent to trusted destinations after they sign in. To do this, the web application only accepted redirects to the Phrase TMS web address itself. However, when a user opens Phrase TMS from Phrase Platform, the sign-in process legitimately moves the user between different Phrase web addresses. Our servers already check each of these redirects against a list of trusted Phrase domains and allow them. The new check in the TMS core application was stricter than this server-side check and overrode it. As a result, legitimate redirects were replaced with the Phrase TMS start page, which started the sign-in process again. Users either looped through sign-in repeatedly or landed back on the Phrase TMS login page with an error. Signing in to Phrase Platform itself kept working throughout the incident, both with a password and with single sign-on. So did signing in with a password directly on the Phrase TMS login page. The failure happened at the step where a signed-in user moves from Phrase Platform into Phrase TMS. Because of this, some affected users reported the problem as a password issue: they entered their credentials successfully but were then sent back to a login screen. ## Actions to Prevent Recurrence 1. **Change rolled back** – The update that caused the issue was rolled back in all production regions at 11:27 AM CEST, which restored normal sign-in. 2. **Continuous sign-in monitoring** – We are adding automated checks that run regularly in all production regions and in our test environment. Each check performs the full sign-in from Phrase Platform into Phrase TMS and immediately alerts our on-call engineers if it fails. Before we rely on them, we will confirm that these checks detect the exact failure that occurred in this incident.

We are currently investigating an issue affecting the synchronization of jobs between Phrase Strings and Phrase TMS via webhooks in our EU region. Customers may experience failures or delays when syncing translation jobs between the two products. Our team is actively working to identify the root cause and restore full functionality as quickly as possible.

A fix has been implemented and deployed to address the webhook synchronization failures between Phrase Strings and Phrase TMS. We are currently monitoring the situation to confirm full stability. We will provide a further update once we have validated the resolution.

We are pleased to confirm that the webhook synchronization issue between Phrase Strings and Phrase TMS has been resolved and verified as fully operational, including for US data center customers. This incident is now closed.