SecurID Outage History

Started Oct 02, 2026, 12:05 AM UTC· resolved Oct 02, 2026, 02:36 AM UTC

1. investigating Oct 02, 2026, 12:05 AM UTC

   We have detected an issue affecting RSA ID Plus. SaaS Operations is investigating the issue and will post updates as they become available.

2. monitoring Oct 02, 2026, 12:43 AM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Oct 02, 2026, 02:36 AM UTC

   After monitoring the fix, SaaS Operations has determined that the incident affecting RSA ID Plus has been resolved. We will post a root cause analysis as soon as it is available.

Read the full incident report →

Started Sep 14, 2026, 06:20 AM UTC· resolved Sep 14, 2026, 07:20 AM UTC

1. resolved Sep 14, 2026, 06:39 PM UTC

   We experienced a service degradation affecting a subset of customers hosted in our EMEA region on the EU Pod 2 deployment. Some customers may have experienced intermittent issues accessing the service. This issue is no longer ongoing. We will post a root cause analysis as soon as it is available.

2. postmortem Sep 17, 2026, 01:35 AM UTC

   **Initial Root Cause Analysis** **Summary** On September 14, 2026, between approximately 06:20 UTC and 07:20 UTC, a subset of customers hosted in the RSA ID Plus EU2 production environment experienced authentication service degradation. During the incident, authentication requests were intermittently unable to complete successfully. Across the affected authentication traffic, RSA estimates that approximately 15–20% of authentication attempts succeeded during the period of degradation. The level of impact varied by customer and authentication flow. **What Happened** Beginning at approximately 06:20 UTC, authentication processing latency and failure rates increased within the EU2 environment. The degradation affected portions of the request-processing path used by the authentication service and resulted in elevated error rates for a subset of customers in the EMEA region. RSA engineering teams investigated the affected services and supporting infrastructure. Service performance improved as processing conditions stabilized, and authentication success rates returned to expected levels by approximately 07:20 UTC. **Root Cause** RSA has not yet identified a definitive root cause for this incident. Our investigation remains active and includes a review of application telemetry, authentication traffic patterns, request-processing behavior, and supporting infrastructure within the EU2 environment. Initial analysis shows that authentication demand, request retries, processing latency, and resource utilization increased during the incident window. RSA is working to establish the relationship among these conditions, determine the sequence of events, and identify which conditions initiated or amplified the degradation. These findings remain preliminary and should not be interpreted as a final determination of root cause. **Resolution** Service performance recovered as the affected processing environment stabilized. RSA engineering teams confirmed that authentication latency, error rates, and service throughput had returned to expected levels and continued monitoring the EU2 environment following recovery. RSA did not initiate regional failover during the incident because the environment remained partially operational and did not meet the criteria for an automated regional transition. RSA maintains regional failover capabilities to support service continuity during regional service events. In this case, preliminary analysis indicated that the conditions contributing to the degradation would likely have followed authentication traffic to the recovery region. Based on those conditions, RSA did not expect a regional transition to resolve the degradation and determined that it could reproduce the same behavior in the recovery environment. RSA has not identified any customer configuration changes required in response to this incident. **Actions and Ongoing Investigation** RSA is continuing a detailed investigation and is taking steps to reduce the likelihood and potential impact of similar events. This work includes: * Analyzing authentication traffic, retry patterns, and service dependencies to establish the complete sequence of events. * Reviewing request-handling and capacity controls to prevent elevated activity associated with a single customer or connection path from affecting other customers in the environment. * Evaluating retry and timeout behavior to reduce amplification during periods of service congestion. * Reviewing load distribution across application components and investigating the uneven error distribution observed during the incident. * Enhancing service telemetry and alerting for processing latency, resource saturation, abnormal retry behavior, and dependencies supporting customer-connected components. * Evaluating additional capacity and resiliency measures for authentication processing within the EU2 environment. RSA will provide an updated RCA within 10 business days of the incident. If the investigation remains open at that time, RSA will provide the findings available to date, the status of remaining investigative work, and any additional corrective actions identified.

Read the full incident report →

Started Apr 01, 2026, 08:15 AM UTC· resolved Apr 01, 2026, 11:02 AM UTC

1. investigating Apr 01, 2026, 08:15 AM UTC

   We have detected an issue affecting RSA ID Plus. SaaS Operations is investigating the issue and will post updates as they become available.

2. investigating Apr 01, 2026, 08:52 AM UTC

   The SecurID SaaS Operations Team continues to investigate this issue. We will provide an update as soon as more information is available. Thank you, The SecurID Team

3. monitoring Apr 01, 2026, 09:25 AM UTC

   The issue affecting RSA ID Plus has been corrected. The SaaS Operations team is monitoring the fix. We will post a root cause analysis as soon as it is available.

4. resolved Apr 01, 2026, 11:02 AM UTC

   After monitoring the fix, SaaS Operations has determined that the incident affecting RSA ID Plus has been resolved. We will post a root cause analysis as soon as it is available.

5. postmortem Apr 02, 2026, 10:11 PM UTC

   **Summary** On 04/01/2026, RSA ID Plus experienced a service outage in the ANZ region, impacting authentication workflows and related services. The issue was caused by a performance issue at the datastore layer caused by a non-optimal query execution pattern within one of the service data tiers, which led to elevated resource utilization and increased latency. This resulted in an authentication service outage. Service was restored through a combination of capacity adjustments and regional failover, and stability has been maintained since recovery. **Preliminary** **Root Cause** The incident was attributed to a query optimizer behavior that resulted in a suboptimal execution plan within the service data tier under specific runtime conditions. Under these conditions, the optimizer selected an inefficient query execution strategy, which led to: * Increased resource consumption within the data tier * Elevated query execution times * Resource contention impacting dependent services These conditions drove increased latency and service instability within authentication workflows. The behavior is consistent with a query plan regression scenario, where the optimizer generates a plan that is not optimal for the current data distribution or workload characteristics. **Recovery** During the incident, the team followed a controlled recovery approach aligned with the platform’s resilience design. RSA ID Plus is architected with strong in-region resilience, including redundancy and scaling capabilities across service layers, as well as a warm secondary region available for failover. In line with this design, the initial response focused on stabilizing the primary region by addressing resource contention within the data tier. Failover to the secondary region is available and was successfully executed as part of the recovery. Based on real-time impact assessment and recovery progress, it was determined that in-region remediation would not restore service within acceptable thresholds. A controlled failover to the secondary region was then initiated. Following stabilization, corrective changes were implemented within the primary region to address the underlying query optimization behavior. Once these changes were validated, traffic was safely transitioned back to the primary region in a controlled manner. All systems have remained stable under continued monitoring since recovery. **Mitigation and Resolution** The following actions were taken to restore service: * **Capacity Adjustment:** Increased available resources within the data tier to reduce contention * **Regional Failover:** Traffic was redirected to a warm region to restore service responsiveness * **Service Stabilization:** Performance returned to normal following these actions **Preventive Actions** **Immediate Actions** * Identification and correction of impacted query behavior * Stabilization of query execution patterns to prevent recurrence **Vendor Engagement and Safeguard Review** As part of the ongoing investigation and prevention efforts, RSA has engaged with our data service provider to further evaluate query optimization behavior observed during the incident. This includes a focused review of existing safeguards and protective mechanisms designed to detect and mitigate suboptimal query execution patterns. While these controls are in place, this event identified conditions under which they did not intervene as expected. This review is actively in progress, and findings will be incorporated into follow-up corrective actions.

Read the full incident report →

Started Jan 15, 2026, 06:45 AM UTC· resolved Jan 15, 2026, 07:15 AM UTC

1. resolved Jan 15, 2026, 12:17 PM UTC

   We have detected an issue affecting the RSA Cloud Authentication Services impacting those customers hosted on our EU1 EMEA deployment. Operations has determined that the incident affecting RSA ID Plus has been resolved. As part of our mitigation efforts, the January service release has been rolled back in the affected EMEA environment. This action was taken as a precaution while our Engineering teams continue the root cause analysis. Service behavior has remained stable since the rollback, and we are continuing to closely monitor the environment. Additional updates will be shared as they become available. We will post a root cause analysis as soon as it is available.

2. postmortem Jan 23, 2026, 06:44 PM UTC

   **Incident Summary** On January 15, 2026 06:45–07:15 UTC, a subset of customers hosted on the EU1 deployment in the EMEA region experienced a degradation in authentication services. The event primarily manifested as intermittent authentication disruption, with the majority of affected tenants experiencing impact for less than 40 minutes. Core platform availability remained operational throughout the event. Most customers were able to authenticate successfully during the impact window, though some authentication flows experienced slower-than-normal response times and elevated failure rates for a limited period. Service behavior returned to normal once mitigation actions were applied. **Root Cause** A January service update introduced a flaw in our upgrade handling which caused some clients to unnecessarily retrieve application resources, creating unexpected request patterns within the authentication flow. This behavior disrupted normal request patterns within the authentication flow and contributed to authentication disruption for a subset of customers. In addition, notifications on the status page occurred later than expected. During the incident, overall service availability remained operational, and the impact presented as intermittent authentication disruption rather than a sustained outage condition. Because successful authentications continued throughout the incident window for most customers, initial indicators aligned with a limited disruption scenario. Customer communication was issued as impact scope was confirmed. **Mitigation and Recovery Actions** During the incident, the following actions were taken: * Rolled back January service updates deployed prior to the incident * Scaled additional capacity within the affected EMEA deployment * Continued real-time monitoring to validate stabilization These actions successfully stabilized the environment. No recurrence has been observed since mitigation was applied. Corrective and Preventive Actions The following actions are under evaluation or implementation: * Improvements to upgrade handling to prevent unnecessary resource refresh behavior * Enhancements to monitoring and alerting to improve visibility into customer-impacting disruption scenarios * Review of incident communication workflows and notification triggers

Read the full incident report →

Started Oct 09, 2025, 06:00 PM UTC· resolved Oct 10, 2025, 01:43 PM UTC

1. resolved Oct 10, 2025, 03:09 PM UTC

   October 9, 2025 Approximately 19:43 UTC and 23:59 UTC A subset of RSA customers experienced intermittent connectivity issues when attempting to access RSA Cloud services. Our internal monitoring confirmed that all RSA service components remained fully operational throughout this period. However, some customer connections to our service were disrupted due to a broader Microsoft network routing issue. Preliminary Root Cause Microsoft has confirmed that this event was part of a large-scale Microsoft / Azure network outage affecting multiple U.S. regions. The issue began at 19:43 UTC (1:43 PM MT) and impacted connectivity for both Microsoft services (including O365 and administrative portals) and third-party applications hosted on Azure. Microsoft is preparing a formal Root Cause Analysis (RCA) for this incident. RSA’s support case has been linked to that investigation, and we will provide updates once Microsoft publishes their findings. Following engagement with Microsoft, Azure Support has confirmed a large-scale network incident affecting multiple U.S. regions and impacting connectivity to various Microsoft and third-party cloud services. Microsoft has associated our support case with their Large-Scale Incident (LSI) and is preparing a formal Root Cause Analysis (RCA), which we will review once available. Impact to RSA Customers - RSA services themselves remained healthy and available. - Some customers were unable to reach RSA Cloud endpoints during the incident due to Microsoft routing disruptions. - Service accessibility returned to normal as Microsoft mitigated the network event. Next Steps RSA continues to work directly with Microsoft to review the final RCA and to ensure that any corrective actions taken at the Azure network level are communicated clearly. Additional updates will be provided through our regular customer communication channels once Microsoft releases their full report.

Read the full incident report →

Started Aug 28, 2025, 07:42 PM UTC· resolved Aug 29, 2025, 12:12 AM UTC

1. identified Aug 28, 2025, 07:42 PM UTC

   We are currently experiencing service degradation affecting SMS delivery to the United States. Customers may notice delays or difficulties when sending messages to US-based recipients. Our team is actively working with our SMS partners to resolve the issue as quickly as possible. Voice OTP is not impacted and remains available as an alternative authentication method.

2. monitoring Aug 28, 2025, 09:22 PM UTC

   Our SMS Partner has marked the issue as resolved at 21:00 UTC. We will continue to monitor for any remaining issues.

3. resolved Aug 29, 2025, 12:12 AM UTC

   After monitoring the fix, SaaS Operations has determined that the incident affecting SMS delivery to the United States has been resolved. We will post a root cause analysis as soon as it is available.

4. postmortem Sep 29, 2025, 11:07 PM UTC

   **Root Cause Analysis – SMS Delivery Incident \(August 28, 2025\)** **Incident Summary** On August 28, 2025, between 15:14 UTC and 21:00 UTC, customers in the United States may have experienced intermittent issues with SMS message delivery. During this time, one of our downstream providers experienced platform instability that caused delivery delays and degraded message quality. Voice services and non-U.S. SMS traffic were unaffected. **Root Cause** The disruption originated with a downstream provider whose internal database systems became unstable, creating message queues and delivery delays across two of their datacenter regions. This caused two periods of degraded service during the afternoon of August 28. Upon identification of the issue, the downstream provider initiated failover procedures to alternate delivery routes. Within minutes, the majority of SMS traffic was stabilized through backup channels. A secondary recurrence later in the afternoon required an additional failover, after which delivery was restored for most customers by 16:19 UTC. Final adjustments ensured all traffic was fully restored by 21:00 UTC. **Preventive Measures** We are working closely with our downstream provider on the following improvements to reduce the likelihood of recurrence: * **Enhanced Failover:** Strengthening U.S. SMS failover processes to allow faster transition to alternate delivery paths during provider instability. * **Provider Safeguards:** Implementation of improved monitoring and alerting by the provider to prevent future database-related issues. * **Resilience Review:** Ongoing joint evaluation of routing strategies within U.S. carrier regulations to expand redundancy and increase flexibility in failover scenarios. In addition, RSA is undertaking the following initiatives to further improve resiliency and visibility: * **Multi-Vendor Strategy:** Assessing options for a multi-vendor delivery model to reduce dependency on any single downstream provider. * **Enhanced Monitoring:** Expanding RSA’s own monitoring and advanced detection capabilities to identify potential delivery degradation earlier, beyond what downstream providers can directly report. We recognize the importance of reliable SMS delivery for our customers. We sincerely apologize for the inconvenience this incident may have caused and are committed to maintaining the highest levels of service availability and resiliency.

Read the full incident report →

Started Aug 05, 2025, 04:17 PM UTC· resolved Aug 05, 2025, 05:25 PM UTC

1. investigating Aug 05, 2025, 04:17 PM UTC

   We have detected an issue affecting RSA ID Plus. SaaS Operations is investigating the issue and will post updates as they become available.

2. monitoring Aug 05, 2025, 04:43 PM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Aug 05, 2025, 05:25 PM UTC

   After monitoring the fix, SaaS Operations has determined that the incident affecting RSA ID Plus Administration Service has been resolved. No Authentication Services were impacted by this incident. We will post a root cause analysis as soon as it is available.

Read the full incident report →

Started Feb 10, 2025, 01:35 PM UTC· resolved Feb 10, 2025, 02:40 PM UTC

1. resolved Feb 10, 2025, 03:19 PM UTC

   SaaS Operations has identified and resolved an issue impacting RSA ID Plus services in this region. We will post a root cause analysis as soon as it is available.

2. postmortem Feb 19, 2025, 10:37 PM UTC

   **Incident Summary:** The RSA ID Plus Cloud Authentication Service \(GOV Region\) was impacted by high latency within one of RSA’s data services tiers, leading to degradation in authentication for customers from approximately 13:35 UTC to 14:40 UTC. RSA Engineering determined that during this time, one of the data service optimizers was experiencing higher-than-normal latency, which impacted the authentication workflow. Some customers experienced timeouts while accessing the Cloud Administration console during this period. **Mitigation Actions:** RSA SaaS Operations was able to identify and disable the impacting workflow to mitigate the risk. We have been continuously monitoring this environment since then. **Recovery:** RSA is continuously taking steps to improve the RSA SecurID Access service and our processes to help ensure such incidents do not occur in the future. In this case, steps include \(but are not limited to\): · Updating the data service queries to reduce the likelihood of a sub-optimal query being selected by the data services optimizer. · While our standard failover procedure would typically be triggered in such incidents, we did not failover to our secondary processing site as the threshold for failover had not been met. Although the service was degraded, we were still processing successful authentications during this period. RSA is reviewing the threshold data from this incident to ensure it aligns with customer experience and service requirements.

Read the full incident report →