Service to the majority of our customers is now fully restored. If you continue to see issues with your application and have not been contacted by us, please reach out to [support@bubble.io](mailto:support@bubble.io). We are continuing to monitor for any further issues, as well as continuing our forensic investigation, and will update this page and email impacted customers as needed. We will continue to provide transparency into what happened as we investigate: we don't expect any further substantial updates til later this week.

Service to the majority of our customers is now fully restored. If you continue to see issues with your application and have not been contacted by us, please reach out to [support@bubble.io](mailto:support@bubble.io). We are still bringing our AI Agent features back online, but all user apps should be editable manually, and we expect the Agent to be available again later this evening. We are continuing to monitor for any further issues, as well as continuing our forensic investigation, and will update this page and email impacted customers as needed. We will continue to provide transparency into what happened as we investigate: we don't expect any further substantial updates til later this week.

Some Bubble functionality remains affected by security measures we introduced in response to a security incident. **Containment** We believe the attacker has been contained and is no longer active in our systems. Since our last update, we have seen no evidence of further access. **Security impact of the attack** Forensic work is ongoing to confirm the full extent of what was accessed. What we can report so far: • At this time, we do not have evidence that the attacker accessed private data of apps hosted on Bubble, or any credentials stored inside non-public Bubble applications. • The attacker was able to access metadata about Bubble plugins. This includes private API keys stored inside those plugins (often used by the plugin developer for testing that plugin). We have emailed the affected plugin developers to let them know that they should rotate potentially-exposed private keys. • The attacker downloaded application data from apps that were set as publicly viewable (see Settings -> General -> "Define who can see and modify the app editor" in the Editor). Apps with this setting were already open to the public, so the attacker did not access any non-public data, but we recommend confirming that this setting is set to "Private app" on your app unless your intention is for the editor in your app to be open to the public. **Service status** Parts of Bubble, including the editor and live apps, remain affected by the measures we took to contain the attack. We’re actively bringing systems back online. We've restored full service for some apps; other apps have impacted functionality including file access, some plugins, and some users being able to access their editors. Our next update will be by 9:30 pm ET

We're continuing to work on restoring functionality. We are working on a more substantial update, and will post it (or another interim check-in) by 9 pm ET.

Containment We believe the attacker has been contained and is no longer active in our systems. Since our last update, we have seen no evidence of further access. Forensic work is ongoing to confirm the full extent of what was accessed. Service status Parts of Bubble, including the editor and live apps, remain affected by the measures we took to contain the attack. We’re actively bringing systems back online, and we’ll share progress as it happens. Impacted functionality includes file access, some plugins, and some users being able to access their editors. Next update By 8:00 PM ET, or sooner if services are restored. Questions: [support@bubble.io](mailto:support@bubble.io).

We are responding to an active security incident. We detected unauthorized access to parts of Bubble’s systems. Our investigation is ongoing. What we know so far We’ve confirmed the attacker accessed third-party tokens and credentials (such as API keys used in API Connector / plugins) belonging to a subset of Bubble users. We are contacting affected users directly. Our investigation is still underway, and this scope may change as we learn more. What you may notice As part of containment, we may temporarily take parts of our infrastructure offline. This may affect both the Bubble editor and live Bubble apps. These interruptions are deliberate steps to protect your data. What you should do We recommend reviewing activity on third-party accounts connected to your Bubble apps for unusual usage. We’ll tell you when to rotate credentials so the new ones stay protected. Beware of phishing Official messages about this incident will come only from [bubble.io](http://bubble.io) and will be posted at [status.bubble.io](http://status.bubble.io). We will never ask for your password or credentials by email. Next update We’ll post our next update by 6 PM ET, or sooner if we learn something important. If you have questions in the interim, please reach out to [support@bubble.io](mailto:support@bubble.io)

We've identified an issue affecting platform availability and will be making a series of infrastructure changes to resolve it. Some disruption is expected while that work is underway, including pages failing to load, workflows timing out, and brief periods where your app is unreachable. Behavior may improve and then recur as changes are made. No action is needed on your side. We'll post updates here as we make progress. If you see something not covered above, reach out to support with your app name and what you're seeing. We know this will be disruptive and we apologize in advance for the impact.