Tessian incident

Reduced Efficacy of Email Exfiltration for some customers

Resolved on May 13, 2026, affecting Proofpoint API and Gateway and 1 more.

resolved May 13, 2026, 04:00 AM UTC

Proofpoint discovered and fixed an issue impacting Email Exfiltration efficacy for a subset of customers. From May 12th 2026 till May 22st 2026, the daily job to identify new Unauthorized address failed to successfully update for a subset of customers. This meant no new unauthorized addresses were associated with end users for those tenants - reducing efficacy over time. • Email Exfiltration still ran against outbound emails, using the list of unauthorized addresses as of May 12th. • Zero day detection was still running, catching potential unauthorized addresses not yet associated with a specific user. Once Proofpoint discovered the issue, we worked quickly to correct the issue moving forward and update all tenants with a current list of Unauthorized Addresses as of May 22nd 2026. Our team investigated the critical miss in monitoring, and is deploying a redesigned method to address the fundamental failure and catch such things in the future. Please feel free to open a support ticket if you have any additional questions.

Started
May 13, 2026, 04:00 AM UTC
Resolved
May 13, 2026, 04:00 AM UTC
Duration
–
Detected by Pingoru
May 13, 2026, 04:00 AM UTC

Affected components

Proofpoint APIGatewayProofpoint Cloud Email Security PlatformProofpoint PortalM365 Add-inCOM Add-in for WindowsCore Email Protection APIAEDLP Email Misdelivery ProtectionAEDLP Email Exfiltration ProtectionAEDLP Custom Policies

Update timeline

  1. resolved May 13, 2026, 04:00 AM UTC

    Proofpoint discovered and fixed an issue impacting Email Exfiltration efficacy for a subset of customers. From May 12th 2026 till May 22st 2026, the daily job to identify new Unauthorized address failed to successfully update for a subset of customers. This meant no new unauthorized addresses were associated with end users for those tenants - reducing efficacy over time. • Email Exfiltration still ran against outbound emails, using the list of unauthorized addresses as of May 12th. • Zero day detection was still running, catching potential unauthorized addresses not yet associated with a specific user. Once Proofpoint discovered the issue, we worked quickly to correct the issue moving forward and update all tenants with a current list of Unauthorized Addresses as of May 22nd 2026. Our team investigated the critical miss in monitoring, and is deploying a redesigned method to address the fundamental failure and catch such things in the future. Please feel free to open a support ticket if you have any additional questions.

Your product runs on more than Tessian

Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.

Add your stack →