Plerdy security incident, August–September 2026

Status: resolved on September 3, 2026. Published: October 28, 2026.

What happened

In August 2026, an attacker gained unauthorised access to Plerdy servers using stolen administrator credentials. From August 27 to September 3, 2026, the Plerdy tracking script contained unauthorised code that tried to load a script from an external domain. Account contact data of Plerdy clients, such as names and email addresses, was accessed.

What we did

• Removed the unauthorised code from the tracking script on September 3, 2026.
• Blocked the attacker's access and replaced all server credentials.
• Reset all Plerdy account passwords and ended all login sessions on September 4, 2026.
• Strengthened the security of our infrastructure.
• Reported the incident to CERT-UA.

What you should know

Plerdy is safe to use. The tracking script on your website is our verified build, and you do not need to change or remove the Plerdy code. If you have questions, email [email protected].

FAQ

Is Plerdy safe to use now?

Yes. The unauthorised code was removed on September 3, 2026, all access was blocked and all credentials were replaced.

Do I need to remove the Plerdy code from my website?

No. The script served now is our verified build.

Were payment cards affected?

No. Plerdy does not store payment card numbers. Payments are processed by Paddle.

Were my passwords exposed?

Plerdy stores passwords only as one-way hashes, so they cannot be read. As a precaution, we reset all Plerdy passwords on September 4, 2026. If you used the same password on other services, change it there.

Was my website visitors' data affected?

We found no evidence that data about visitors of our clients' websites was taken.

What should I watch out for?

Be careful with unexpected emails that ask for your password or a payment. Plerdy never asks for your password by email.

Who can I contact?

Email [email protected]. We will answer your questions and can share technical details with your security team.