Plerdy security incident, August–September 2026

Status: resolved on September 3, 2026. Updated: November 6, 2026.

What happened

In August 2026, an attacker gained unauthorised access to Plerdy servers using stolen administrator credentials. From August 27 to September 3, 2026, the Plerdy tracking script contained unauthorised code that loaded a script from an external domain. Account contact data of Plerdy clients, such as names and email addresses, was accessed. Plerdy stores passwords only as one-way hashes, so they cannot be read; as a precaution, we reset all passwords on September 4, 2026. Plerdy does not store payment card numbers.

On November 4, 2026, the security company Sekoia published research on a wider campaign that it attributes to the APT29 group. The research describes Plerdy as a compromised third party.

What the unauthorised code could do

According to Sekoia, the external script checked the visitor's device. On mobile phones with outdated iOS or Android, it could try to use known security flaws that have already been fixed by Apple and Google. Devices with up-to-date software are not affected by these attacks.

Sekoia could not retrieve the script used in the Plerdy case. We have no evidence that any visitor was compromised through it.

What we did

Removed the unauthorised code from the tracking script on September 3, 2026.
Blocked the attacker's access and replaced all server credentials.
Reset all Plerdy account passwords and ended all login sessions on September 4, 2026.
Strengthened the security of our infrastructure.
Reported the incident to CERT-UA and shared technical data for the investigation.

What you should know

Plerdy is safe to use. The tracking script on your website is our verified build, and you do not need to change or remove the Plerdy code. As a precaution, keep iOS, Android and browsers updated, and recommend the same to your team. If you have questions, email [email protected].

FAQ

Is Plerdy safe to use now?

Yes. The unauthorised code was removed on September 3, 2026, all access was blocked and all credentials were replaced.

Do I need to remove the Plerdy code from my website?

No. The issue was fixed on September 3, 2026. The script served now is our verified build.

Is this the incident described by Sekoia?

Yes. Sekoia's research covers the same period, August 27 to September 3, 2026, and describes Plerdy as a compromised third party.

Were visitors of my website affected?

Only mobile phones with outdated iOS or Android could be at risk, according to Sekoia. Devices with up-to-date software were not. We have no evidence that any visitor was compromised. Visitors who use outdated software should update it.

Were payment cards affected?

No. Plerdy does not store payment card numbers. Payments are processed by Paddle.

Were my passwords exposed?

Plerdy stores passwords only as one-way hashes, so they cannot be read. As a precaution, we reset all Plerdy passwords on September 4, 2026. If you used the same password on other services, change it there.

What has changed since the incident?

We replaced all server credentials, reset the passwords of all accounts and ended all login sessions. The tracking script is built automatically from the code in our version control system and is not edited by hand on servers. Clients can turn on two-step login with a one-time code sent by email. More about how we protect data in our Security Policy.

Who else investigated the incident?

We reported the incident to CERT-UA and shared technical data for the investigation. Sekoia researched the campaign independently of us, and the period it describes, from August 27 to September 3, 2026, matches our data.

Can I get a technical report about the incident?

Yes. Email [email protected], and we will send your security team a technical description: the timeline, the measures taken and the indicators of compromise (IOCs) you can use to check your systems.

How can I check that Plerdy on my website is safe now?

Your security team can see which files the page loads in the Network tab of the browser's developer tools. On request, we will provide the list of domains Plerdy works from and the indicators of compromise for comparison.