Service to the majority of our customers is now fully restored. If you continue to see issues with your application and have not been contacted by us, please reach out to support@bubble.io.
We are still bringing our AI Agent features back online, but all user apps should be editable manually, and we expect the Agent to be available again later this evening.
We are continuing to monitor for any further issues, as well as continuing our forensic investigation, and will update this page and email impacted customers as needed. We will continue to provide transparency into what happened as we investigate: we don't expect any further substantial updates til later this week.
Monitoring
Service to the majority of our customers is now fully restored. If you continue to see issues with your application and have not been contacted by us, please reach out to support@bubble.io.
We are still bringing our AI Agent features back online, but all user apps should be editable manually, and we expect the Agent to be available again later this evening.
We are continuing to monitor for any further issues, as well as continuing our forensic investigation, and will update this page and email impacted customers as needed. We will continue to provide transparency into what happened as we investigate: we don't expect any further substantial updates til later this week.
Identified
Some Bubble functionality remains affected by security measures we introduced in response to a security incident.
Containment
We believe the attacker has been contained and is no longer active in our systems. Since our last update, we have seen no evidence of further access.
Security impact of the attack
Forensic work is ongoing to confirm the full extent of what was accessed. What we can report so far:
• At this time, we do not have evidence that the attacker accessed private data of apps hosted on Bubble, or any credentials stored inside non-public Bubble applications.
• The attacker was able to access metadata about Bubble plugins. This includes private API keys stored inside those plugins (often used by the plugin developer for testing that plugin). We have emailed the affected plugin developers to let them know that they should rotate potentially-exposed private keys.
• The attacker downloaded application data from apps that were set as publicly viewable (see Settings -> General -> "Define who can see and modify the app editor" in the Editor). Apps with this setting were already open to the public, so the attacker did not access any non-public data, but we recommend confirming that this setting is set to "Private app" on your app unless your intention is for the editor in your app to be open to the public.
Service status
Parts of Bubble, including the editor and live apps, remain affected by the measures we took to contain the attack. We’re actively bringing systems back online. We've restored full service for some apps; other apps have impacted functionality including file access, some plugins, and some users being able to access their editors.
Our next update will be by 9:30 pm ET
Identified
We're continuing to work on restoring functionality. We are working on a more substantial update, and will post it (or another interim check-in) by 9 pm ET.
Identified
Containment
We believe the attacker has been contained and is no longer active in our systems. Since our last update, we have seen no evidence of further access. Forensic work is ongoing to confirm the full extent of what was accessed.
Service status
Parts of Bubble, including the editor and live apps, remain affected by the measures we took to contain the attack. We’re actively bringing systems back online, and we’ll share progress as it happens. Impacted functionality includes file access, some plugins, and some users being able to access their editors.
Next update
By 8:00 PM ET, or sooner if services are restored. Questions: support@bubble.io.
Identified
We are responding to an active security incident. We detected unauthorized access to parts of Bubble’s systems. Our investigation is ongoing.
What we know so far
We’ve confirmed the attacker accessed third-party tokens and credentials (such as API keys used in API Connector / plugins) belonging to a subset of Bubble users. We are contacting affected users directly. Our investigation is still underway, and this scope may change as we learn more.
What you may notice
As part of containment, we may temporarily take parts of our infrastructure offline. This may affect both the Bubble editor and live Bubble apps. These interruptions are deliberate steps to protect your data.
What you should do
We recommend reviewing activity on third-party accounts connected to your Bubble apps for unusual usage. We’ll tell you when to rotate credentials so the new ones stay protected.
Beware of phishing
Official messages about this incident will come only from bubble.io and will be posted at status.bubble.io. We will never ask for your password or credentials by email.
Next update
We’ll post our next update by 6 PM ET, or sooner if we learn something important. If you have questions in the interim, please reach out to support@bubble.io
Investigating
We've identified an issue affecting platform availability and will be making a series of infrastructure changes to resolve it. Some disruption is expected while that work is underway, including pages failing to load, workflows timing out, and brief periods where your app is unreachable. Behavior may improve and then recur as changes are made.
No action is needed on your side. We'll post updates here as we make progress. If you see something not covered above, reach out to support with your app name and what you're seeing.
We know this will be disruptive and we apologize in advance for the impact.