Maropost Identity – Security Incident Postmortem

Affected Service: Maropost Identity (Login and Authentication)
Incident Period: 26–30 September 2026
Remediation and Global Credential Reset Completed: 6 October 2026
Status: Resolved

Overview

Between 26 and 30 September 2026, Maropost identified unauthorised activity involving Maropost Identity, the authentication service used to securely access Maropost products.

Our investigation determined that an external party exploited a security vulnerability within the identity service, allowing unauthorised administrative access.

Importantly, user passwords are stored using secure, one-way cryptographic hashing. Our investigation found no evidence that stored password hashes were extracted or that plaintext passwords were exposed.

Upon identifying the activity, our Engineering and Security teams took immediate action to contain the incident, investigate its impact and implement corrective measures.

The identified vulnerability has since been remediated, and a global credential reset was completed on 6 October 2026 as a precautionary security measure.

What Happened

The incident involved a vulnerability within the password-reset functionality of Maropost Identity.

This vulnerability was exploited by an unauthorised third party, who subsequently gained elevated access within the identity service.

Our investigation identified the following activity:

• Unauthorised access to identity account information, including user names and email addresses.
• An unusually high volume of password-reset requests across customer and internal accounts.
• Unauthorised changes to login credentials and multi-factor authentication (MFA) settings on a subset of accounts.

Our teams identified abnormal activity on 30 September 2026 and took immediate action to investigate and contain the incident.

Customer Impact

Our investigation identified unauthorised access to Maropost Identity account information, including user names and email addresses.

While unauthorised credential and multi-factor authentication (MFA) changes were identified on a subset of accounts, Maropost subsequently invalidated existing sessions and completed a global credential reset to protect users.

Actions Taken to Resolve the Incident

Following detection, Maropost's Engineering and Security teams implemented several measures to contain the incident and secure the identity service.

Security Vulnerability Remediation

The affected identity software was upgraded, and verification testing was conducted to confirm the identified vulnerability had been addressed.

Unauthorised Access Containment

Network sources associated with the suspicious activity were blocked, and administrative access controls were strengthened.

Credential and Session Security

Existing user sessions were invalidated, relevant application and integration credentials were rotated, and administrative accounts were reviewed.

Global Password and MFA Reset

On 6 October 2026, Maropost completed a global reset of user passwords, MFA configurations and recovery codes to eliminate the risk of continued access through previously modified credentials.

Account Verification

Additional account reviews were undertaken, including the disabling of unverified accounts identified during the investigation.

Preventive Measures

In addition to the immediate remediation, Maropost is implementing further security improvements to strengthen Maropost Identity and reduce the risk of similar incidents.

These improvements include:

• Strengthening administrative access restrictions and authentication controls.
• Enhancing monitoring and alerting for unusual login and password-reset activity.
• Improving application and integration security controls.
• Strengthening vulnerability management and software update processes.
• Conducting additional security assessments and reviewing incident response procedures.

These measures form part of our ongoing commitment to maintaining the security and reliability of Maropost services.

Do Customers Need to Take Any Action?

Customers who successfully reset their Maropost Identity password and reconfigured their multi-factor authentication on or after 6 October 2026 do not need to repeat that process as part of this incident.

Customers who have not yet completed the required reset should select Forgot Password on the Maropost Identity login page and follow the instructions provided.

As a general security precaution, we encourage customers to remain vigilant for unexpected password-reset requests, suspicious emails or attempts to obtain account credentials. Maropost will never request that customers disclose their passwords or MFA recovery codes.

For further guidance, please refer to:

Maropost Identity password reset – what you need to do

If you experience difficulty accessing your account or identify unexpected account activity, please contact our Support team:

Contact Maropost Support

Closing Statement

Protecting our customers, their accounts and their information remains a priority for Maropost.

We recognise the importance of maintaining trust in our services and have taken steps to address the identified vulnerability, secure affected authentication credentials and strengthen the controls protecting Maropost Identity.

We will continue reviewing and improving our security practices as part of our ongoing commitment to safeguarding customer information.