1Password says a recent incident that caused customers to receive notifications about changed passwords was the result of service disruption and not a security breach.
The company first revealed in an
incident report five days ago that the notifications were erroneous and linked to routine database maintenance scheduled on Thursday, April 27th.
Today, 1Password chief technology officer (CTO) Pedro Canahuati provided more details and said the customers' information was unaffected.
"On April 27th, between 9:03 PM and 9:26 PM ET, 1Password experienced a brief service outage. This was not a security incident, and customer data was not affected in any way," said Canahuati.
"The client applications displayed an incorrect message stating: Your Secret Key or password was recently changed. Enter your new account details to continue."
However, as Canahuati explained, this didn't happen. The erroneous alerts were triggered by 1Password's U.S. servers responding to a spike of sync requests following the migration of backend databases with sign-in rejections.
The client applications interpreted the error code sent from the servers incorrectly and displayed the incorrect password change alerts on customers' devices in the United States region.
However, these alerts did not go unnoticed, with 1Passwords users worried that their accounts were hacked or that the company suffered a security incident.
