Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

US critical infrastructure monitor

WorkOS

Cloud, identity and critical software · CA (headquarters)

Monitoring
Not checked: the site's robots.txt does not allow it.: last success Nov 6 12:35 UTC
Public findings
1
Provider status posts on record
50

Cyber and operational findings

Analyst-reviewed records. The grade states how well the cause is established; event, first public observation and acknowledgement are separate dates.

A ConfirmedStatus: ongoing

External access to the affected application disabled; access controls on internal tools reviewed. Founder says 'fully contained'. No credential rotation or session revocation mentioned publicly.

Event: Oct 30
First public: Nov 2
Third-party report: Nov 3
Acknowledged: Nov 2

Other explanations considered: Managed CDN auto-renewal; workos.com tripped the volume flag in 4 of 13 baseline weeks (31 percent).

  1. Oct 30 · DET
    WorkOS identified unauthorized access to an internal application used by its sales team on 30 Oct 2026 (seed register cites 16:39Z from a customer relay; not in public bulletin).
    Source
  2. Oct 30 00:00 UTC · CON
    External access to the affected application disabled; access controls on internal tools reviewed. Founder says 'fully contained'. No credential rotation or session revocation mentioned publicly.
    Source
  3. 2026-10-30 to 2026-11-02 · REM
    Independent DFIR firm retained (unnamed). Founder cites attacker user agents 'artex-enrich/1.0' and 'norma/0.4' (ARTEX tooling, reported not proven).
    Source
  4. Nov 2 · DIS
    Bulletin 'October 30, 2026 Data Security Incident' last updated 2 Nov; affected customers to be contacted directly; phishing warning. Re-verified 5 Nov: no newer update.
    Source
  5. Oct 30 00:00 UTC · DIS
    Window issuance within baseline (4 coalesced vs 5.96 expected, p=0.85). Certificates for trust.workos.com (09:27Z and 12:12Z) and ask.workos.com (14:51Z, 15:21Z) on 3 Nov, the day BleepingComputer reported the incident; both names existed before, both are...
    Source

Provider status posts

Collected from the organisation's own public status page. These are its words; DFX adds only the wording classification.

  • SSO Profile API TimeoutsOct 29 17:34 UTC · resolved · major impact
    Sign-in disruptionInvestigation mentionedRestoration reported
    1. Oct 29 17:34 UTC investigating: We are investigating timeouts on the /sso/profile endpoint. We apologize for the inconvenience and will share an update once we have more information.
    2. Oct 29 17:54 UTC identified: We've identified the issue causing the SSO profile API timeouts and are working on a fix.
    3. Oct 29 18:13 UTC monitoring: We’ve resolved the issue causing timeouts on the SSO profile API and are monitoring.
    4. Oct 29 19:52 UTC resolved: This incident has been resolved.
    View on the provider's status page
  • Elevated errors across SSO and AuthKitOct 23 15:57 UTC · resolved · major impact
    Sign-in disruptionRestoration reported
    1. Oct 23 15:57 UTC investigating: We are seeing elevated errors and request latency across SSO and AuthKit due to network degradation and an upstream provider.
    2. Oct 23 16:09 UTC monitoring: We're seeing recovery across services and will continue to monitor.
    3. Oct 23 17:01 UTC resolved: This is now resolved. Errors and latency were elevated between 15:21 and 15:50 UTC primarily for requests served by MIA and ATL with some impact on the US east coast and northern South America.
    View on the provider's status page
  • Elevated AuthKit Error RatesOct 19 19:23 UTC · resolved · major impact
    Investigation mentionedRestoration reported
    1. Oct 19 19:23 UTC investigating: We are investigating elevated error rates from 19:09 to 19:16 UTC.
    2. Oct 19 19:27 UTC identified: The issue has been identified and a fix is being implemented.
    3. Oct 19 19:27 UTC identified: We are continuing to work on a fix for this issue.
    4. Oct 19 20:21 UTC resolved: This incident has been resolved.
    View on the provider's status page
  • Radar SMS challenge failures for phone numbers in mainland China (+86)Oct 15 17:17 UTC · resolved · major impact
    Investigation mentionedRestoration reported
    1. Oct 15 17:17 UTC investigating: We are investigating an issue affecting Radar SMS challenge verification for phone numbers in mainland China (+86). Affected users may not receive verification codes or may encounter an error when requesting one, preventing them from completing verification. We will provide an...
    2. Oct 15 17:55 UTC monitoring: We are seeing some recovery after our upstream provider has enabled alternate delivery routes. We are continuing to monitor.
    3. Oct 15 21:51 UTC resolved: We've resolved the issue with Radar SMS challenge verifications to China.
    View on the provider's status page
  • Elevated errors across SSO and AuthKit sign-inOct 9 19:30 UTC · resolved
    Service restricted or degradedSign-in disruptionRestoration reported
    1. Oct 9 22:26 UTC resolved: From 20:20 to 20:21 UTC on October 9, 2026 some SSO and AuthKit sign-in requests failed with HTTP 500 errors. The failures hit SSO token exchange and AuthKit authenticate requests. A database maintenance operation conflicted with live sign-in traffic. The operation...
    View on the provider's status page
  • Elevated errors for Audit LogsOct 1 21:16 UTC · resolved · minor impact
    Investigation mentionedRestoration reported
    1. Oct 1 21:16 UTC investigating: We are currently investigating this issue.
    2. Oct 1 21:20 UTC monitoring: Between 20:39 and 20:41 UTC on October 1, 2026, the Audit Logs API returned elevated errors (HTTP 500 and 408 timeouts) for roughly one minute. Some requests to create audit log events, and a small number of export requests, failed in this window. Requests have succeeded...
    3. Oct 1 21:58 UTC resolved: This incident has been resolved.
    View on the provider's status page
  • Elevated API and AuthKit errors for some requests (Columbus, OH region)Oct 1 15:30 UTC · resolved · minor impact
    Sign-in disruption
    1. Oct 9 19:50 UTC resolved: On October 1, 2026, from 11:34 to 11:40 AM EDT, our CDN provider had a network problem at its Columbus, Ohio location. Some requests to the WorkOS API (api.workos.com) and to AuthKit-hosted pages failed with HTTP 500 or 403 errors. Only requests routed through that location were...
    View on the provider's status page
  • Elevated API ErrorsSep 18 22:49 UTC · postmortem · major impact
    Service restricted or degradedSign-in disruptionInvestigation mentionedRestoration reported
    1. Sep 18 22:49 UTC investigating: We are investigating an issue with our API. We apologize for the inconvenience and will share an update once we have more information.
    2. Sep 18 23:01 UTC investigating: We're continuing to investigate this issue to identify the root cause. We'll share another update soon.
    3. Sep 18 23:05 UTC identified: We've identified the root cause, and we're seeing services are beginning to recover. We'll continue to monitor closely and share updates.
    4. Sep 18 23:09 UTC monitoring: Our initial remediations are in place, and services have recovered. We're continuing to monitor closely.
    5. Sep 18 23:29 UTC resolved: Our remediations continue to be effective, and services continue to be recovered. We will continue further investigation and additional preventative measures.
    6. Sep 22 00:53 UTC postmortem: # Elevated API Errors **Date:** 09/18/2026 **Duration:** 22:40–23:03 UTC \(23 minutes\) **Status:** Resolved ## Summary On September 18, 2026, from 22:40 to 23:03 UTC, WorkOS experienced an outage affecting authentication and other API requests. Customers encountered failed...
    View on the provider's status page
  • Elevated Admin Portal ErrorsSep 14 19:08 UTC · resolved · major impact
    Investigation mentionedRestoration reported
    1. Sep 14 19:08 UTC investigating: We are investigating an issue loading Admin Portal links for customers without custom domains. We will share more information as soon as it's available.
    2. Sep 14 19:16 UTC monitoring: We've fixed an issue affecting Admin Portal links for customers without custom domains and are monitoring.
    3. Sep 14 20:00 UTC resolved: We've resolved an issue loading Admin Portal links for customers without custom domains. If you're still experiencing issues please contact support.
    View on the provider's status page
  • Form POST failures for some Authkit customersSep 9 21:00 UTC · postmortem · major impact
    Service taken offlineService restricted or degradedProvider used security languageSign-in disruptionRestoration reported
    1. Sep 9 23:00 UTC investigating: We are seeing an elevated error rate for some customers for POST requests. This appears to be limited to a small subset of organizations using custom domains for hosted Authkit
    2. Sep 9 23:02 UTC resolved: We have identified the source of the problem. A configuration change that applied to roughly 2% of organizations using a custom domain for hosted Authkit resulted in form submission errors. The configuration has been reverted and service restored.
    3. Sep 16 21:10 UTC postmortem: We're sorry for the disruption this incident caused for you and your users. Authentication is a critical path, and during this window we did not meet the reliability standard you expect from WorkOS. We take responsibility for the impact. Service was restored the same day, and we...
    View on the provider's status page
  • Static asset delivery failuresSep 2 16:39 UTC · resolved · major impact
    Restoration reported
    View on the provider's status page
  • Degraded outbound email deliveryAug 31 14:10 UTC · resolved · minor impact
    Service restricted or degradedInvestigation mentionedRestoration reported
    View on the provider's status page
  • Degraded Vault pages in DashboardAug 27 13:48 UTC · resolved
    Service restricted or degraded
    View on the provider's status page
  • Dashboard sign-in errorsAug 25 17:35 UTC · resolved · major impact
    Sign-in disruptionInvestigation mentionedRestoration reported
    View on the provider's status page
  • Elevated errors on AuthKit authentication endpointsAug 19 00:00 UTC · resolved
    Sign-in disruptionRestoration reported
    View on the provider's status page
  • Delayed Email DeliverabilityAug 15 00:24 UTC · resolved · minor impact
    Service restricted or degradedRestoration reported
    View on the provider's status page
  • Delayed Email DeliverabilityAug 14 20:14 UTC · resolved
    Service restricted or degradedInvestigation mentionedRestoration reported
    View on the provider's status page
  • Intermittent Dashboard sign-in errorsAug 11 18:02 UTC · resolved · minor impact
    Sign-in disruptionInvestigation mentionedRestoration reported
    View on the provider's status page
  • Webhook Telemetry IssueAug 5 18:04 UTC · resolved
    Investigation mentioned
    View on the provider's status page
  • Elevated Authkit SSO ErrorsJul 31 16:01 UTC · resolved · major impact
    Service restricted or degradedSign-in disruptionInvestigation mentionedRestoration reported
    View on the provider's status page
  • Delayed Email DeliverabilityJul 29 18:30 UTC · resolved · minor impact
    Service restricted or degradedInvestigation mentionedRestoration reported
    View on the provider's status page
  • Webhook Delivery DelaysJul 27 19:09 UTC · resolved · minor impact
    Service restricted or degradedInvestigation mentionedRestoration reported
    View on the provider's status page
  • Continued email delivery errorsJul 27 14:10 UTC · resolved · major impact
    Investigation mentionedRestoration reported
    View on the provider's status page
  • Elevated errors during email deliveryJul 27 10:05 UTC · resolved · major impact
    Investigation mentionedRestoration reported
    View on the provider's status page
  • Email Delivery DelaysJul 22 01:35 UTC · resolved · minor impact
    Service restricted or degradedInvestigation mentionedRestoration reported
    View on the provider's status page

Documented dependents

Organisations publicly documented as relying on this provider. A relationship is not an impact.

WorkOS
verified
  • WorkOS customers (3,000+ companies use WorkOSNo confirmed impact
  • affected count undisclosed)No confirmed impact