Aug <var data-var='date'>14</var>, <var data-var='time'>13:09</var> PDT Resolved - Security Advisory: CloudSEK Disclosure — TeamPCP / Trivy Supply Chain Campaign Published: August 13, 2026 Status: Resolved — no customer impact Customer action required: None Summary Obsidian Security is aware of the CloudSEK disclosure regarding the TeamPCP supply chain campaign, which targeted CI/CD pipelines and AI infrastructure beginning in March 2026 and named 2,500+ affected companies. Obsidian is listed among them. The data published by CloudSEK corresponds to the original Trivy-based campaign that affected our CI/CD systems in mid-March 2026 — an incident we detected at the time, fully investigated, and remediated. No customer data was exposed at any time. A limited set of Obsidian internal secrets and CI/CD configurations were exposed. The secrets were all unusable in the hands of a third party outside owing to our defense-in-depth protections and swift incident response. All were revoked and rotated in March 2026, and we confirmed that none were used to make any unauthorized access. What Happened Mid-March 2026 — Original incident - Our CI/CD systems were impacted by the Trivy supply chain campaign. - Some internal secrets and CI/CD configuration were potentially exposed. - We detected the activity immediately and initiated an incident response. Our findings: - No customer data or customer secrets were affected. - Any exfiltrated secrets were unusable on their own due to our defense-in-depth posture. - No unauthorized access occurred. Remediation completed at the time: - Revoked and rotated all secrets used in the CI/CD pipeline. - Hardened how our CI/CD pipeline pulls in open-source dependencies and implemented restrictions August 2026 — CloudSEK publication CloudSEK apparently obtained and published data from the Trivy campaign, listing 2,500+ impacted companies including Obsidian. Our response: - Engaged directly with CloudSEK and obtained the full incident report, including raw log files. - Confirmed the published data originates entirely from the mid-March 2026 incident — there is no new or additional exposure. - Reconfirmed that every internal secret appearing in the report had already been rotated in March 2026. - Verified that none of the exposed secrets were used in any access attempt. Any such attempt would have failed given our layered controls. - Re-evaluating our disclosure criteria Why We Did Not Disclose Earlier Obsidian is continuously targeted, as are all security vendors. We assessed the March 2026 incident against our disclosure criteria and determined that no customer sensitive information was exfiltrated and no customer environment was affected. The incident was contained, remediated, and closed. We are publishing now because the CloudSEK report has brought the underlying data into public view, and we want customers to have an accurate account of what it does and does not represent. We are re-evaluating our disclosure criteria. We remain committed to earning our customers’ trust through transparency, and in the future we anticipate releasing more information about attacks that exfiltrate data, even if we do not consider the data to be sensitive. Current Status We have found no new evidence of unauthorized access and have had no incidents reported. We continue to monitor and will provide updates if our assessment changes. Contact Customers with questions are welcome to reach out to their Obsidian account team or our support team directly at support@obsidiansecurity.com. We are happy to schedule a call to walk through the details of this advisory.

Security Advisory: CloudSEK Disclosure - TeamPCP / Trivy Supply Chain Campaign

Jun <var data-var='date'>20</var>, <var data-var='time'>18:00</var> PDT Completed - The scheduled maintenance has been completed. Jun <var data-var='date'>20</var>, <var data-var='time'>17:00</var> PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Jun <var data-var='date'>11</var>, <var data-var='time'>06:09</var> PDT Scheduled - we will be performing scheduled database maintenance during this time

Database maintenance in EU region

Jun <var data-var='date'>12</var>, <var data-var='time'>18:08</var> PDT Resolved - This issue is resolved. We have verified that the issue affecting a subset of identity-centric detections and related alert notifications within the Obsidian US environment has been fully mitigated. Alerting is operating as expected, and this incident is now resolved. Jun <var data-var='date'>12</var>, <var data-var='time'>09:31</var> PDT Monitoring - We have identified an issue that delayed a subset of identity-centric detections and related alert notifications within the Obsidian US environment beginning on 06/03/26. A fix has been applied, and backlog processing for the affected detections is in progress. As processing continues, customers may receive delayed alerts generated from previously queued detections. We are actively monitoring recovery and will share another update once backlog processing is complete.

[US Region] - Delayed Identity-Centric Alerts

Jun <var data-var='date'> 9</var>, <var data-var='time'>08:29</var> PDT Resolved - This issue is resolved. We have taken mitigating actions to restore processing, and batch (non-real-time) alerts are now processing normally. Alerting workflows impacted by this issue have resumed as expected, and we are no longer seeing ongoing delay related to this event. Jun <var data-var='date'> 9</var>, <var data-var='time'>07:38</var> PDT Investigating - We are investigating an issue that may result in delayed delivery of batch (non-real-time) alerts for a subset of customers within the US Region. At this time, real-time alerting is not impacted. Our team is actively working to restore normal processing and reduce any alerting delays. We will continue to provide updates as we make progress.

[US Region] - Subset of Alerts Delayed

Jun <var data-var='date'> 6</var>, <var data-var='time'>08:00</var> PDT Completed - The scheduled maintenance has been completed. Jun <var data-var='date'> 6</var>, <var data-var='time'>07:00</var> PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. May <var data-var='date'>29</var>, <var data-var='time'>17:37</var> PDT Scheduled - We will be undergoing scheduled maintenance during this time

Infrastructure component upgrade for EU region

May <var data-var='date'>30</var>, <var data-var='time'>02:00</var> PDT Completed - The scheduled maintenance has been completed. May <var data-var='date'>30</var>, <var data-var='time'>01:01</var> PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. May <var data-var='date'>29</var>, <var data-var='time'>17:36</var> PDT Scheduled - We will be undergoing scheduled maintenance during this time

May <var data-var='date'>30</var>, <var data-var='time'>01:00</var> PDT Completed - The scheduled maintenance has been completed. May <var data-var='date'>30</var>, <var data-var='time'>00:00</var> PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. May <var data-var='date'>29</var>, <var data-var='time'>17:35</var> PDT Scheduled - we will be undergoing scheduled maintenance during this time

Scheduled Backend Upgrade in US West Environment

May <var data-var='date'>29</var>, <var data-var='time'>23:00</var> PDT Completed - The scheduled maintenance has been completed. May <var data-var='date'>29</var>, <var data-var='time'>22:00</var> PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. May <var data-var='date'>29</var>, <var data-var='time'>17:31</var> PDT Scheduled - We will be undergoing scheduled maintenance to perform upgrade during this time

Scheduled backend upgrade in AU environment

May <var data-var='date'>27</var>, <var data-var='time'>07:25</var> PDT Resolved - We have verified that the issue affecting a subset of threat detections in US region environments has been fully mitigated. Alerting is operating as expected, and this incident is now resolved. May <var data-var='date'>27</var>, <var data-var='time'>06:44</var> PDT Monitoring - Mitigation actions have been fully implemented for the issue affecting a subset of threat detections in US region environments. We are monitoring and reviewing telemetry to confirm the issue has been fully addressed and will provide further updates as needed May <var data-var='date'>27</var>, <var data-var='time'>06:09</var> PDT Identified - We have identified the underlying issue affecting a subset of threat detections in US region environments and are taking actions to fully mitigate the impact. We will continue to provide updates as progress is made. May <var data-var='date'>27</var>, <var data-var='time'>05:40</var> PDT Investigating - We are currently investigating an issue affecting a subset of threat detections in US region environments that may result in delayed alerting for impacted detections.

[US Region] - Subset of threat detections delayed

May <var data-var='date'>15</var>, <var data-var='time'>14:03</var> PDT Resolved - This incident has been resolved. Monitoring has confirmed that service has returned to normal operation, and threat detections are processing as expected. May <var data-var='date'>15</var>, <var data-var='time'>12:25</var> PDT Monitoring - The root cause of the issue affecting a subset of threat detections has been identified, and corrective actions have been taken. We are currently monitoring to ensure full resolution and will provide additional updates as needed. May <var data-var='date'>15</var>, <var data-var='time'>09:49</var> PDT Update - We are continuing to investigate the root cause of the issue affecting a subset of threat detections. Our team remains actively engaged, and we will provide additional updates as more information becomes available. May <var data-var='date'>15</var>, <var data-var='time'>08:10</var> PDT Investigating - Monitoring has detected a recurrence of the issue impacting a subset of threat detections, and investigation has resumed. We are actively investigating and will provide further updates as our investigation progresses.

Subset of Detections Delayed

May <var data-var='date'>15</var>, <var data-var='time'>07:47</var> PDT Resolved - A fix to address an issue resulting in detection and alerting delays for a subset of threat detections has been deployed. Telemetry and post fix validation confirm a return to normal service operation. May <var data-var='date'>15</var>, <var data-var='time'>07:05</var> PDT Investigating - We are currently investigating an issue impacting a subset of threat detections and resulting in delayed alerting for impacted detections

Subset of detections delayed

Mar <var data-var='date'>11</var>, <var data-var='time'>07:34</var> PDT Resolved - A fix to address the issue of "Not Found" errors being displayed upon attempt to load Obsidian Environments has been released, and telemetry and post fix validation confirm a return to normal service operation. Mar <var data-var='date'>11</var>, <var data-var='time'>07:07</var> PDT Update - We are currently investigating an issue that is resulting in users encountering a "Not Found" / HTTP-404 error when attempting to access Obsidian environments. Mar <var data-var='date'>11</var>, <var data-var='time'>07:05</var> PDT Investigating - We are currently investigating an issue that is resulting in users encountering a "Not Found" / HTTP-404 error when attempting to access Obsidian environments.

Not Found  ( HTTP-404) Errors when attempting to access Obsidian Environment

Mar <var data-var='date'>11</var>, <var data-var='time'>04:47</var> PDT Resolved - This incident has been resolved. Mar <var data-var='date'>11</var>, <var data-var='time'>04:23</var> PDT Update - The backfill process is nearing completion, and activity data is now mostly up to date. We will continue to monitor the system as the remaining backfill completes Mar <var data-var='date'>11</var>, <var data-var='time'>01:59</var> PDT Monitoring - The activity data is catching up, and we are closely monitoring the system's performance. We will provide another update once the system is fully up to date with the activity data. Mar <var data-var='date'>11</var>, <var data-var='time'>01:57</var> PDT Update - The issue has been identified and a fix is being implemented. Mar <var data-var='date'>11</var>, <var data-var='time'>00:51</var> PDT Investigating - We have identified an issue that may result in delayed event population within the activity module. Our teams are currently working to mitigate the issue and any updates will be posted on this incident notification.

Activity timeline delay

Mar <var data-var='date'> 1</var>, <var data-var='time'>02:00</var> PST Completed - The scheduled maintenance has been completed. Feb <var data-var='date'>27</var>, <var data-var='time'>02:00</var> PST In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Feb <var data-var='date'>23</var>, <var data-var='time'>14:17</var> PST Scheduled - We will be undergoing scheduled maintenance during this time.

Infrastructure component upgrade for AU region

Feb <var data-var='date'> 9</var>, <var data-var='time'>14:50</var> PST Resolved - We have fully resolved the issue that was impacting the US environment. System performance and operation have returned to normal levels, and all services are functioning as expected. Our team will continue to monitor the environment closely, but no further impact is anticipated at this time. Thank you for your patience while we work to restore normal operation. Feb <var data-var='date'> 9</var>, <var data-var='time'>14:37</var> PST Monitoring - We have implemented mitigation actions to address the issue impacting the US / live environment, and we are seeing improved performance at this time. Our engineering team is actively monitoring the system to ensure stability and will continue to take additional corrective steps as needed. We will provide another update in 1 hour, or sooner, if there are any significant changes. Feb <var data-var='date'> 9</var>, <var data-var='time'>14:06</var> PST Update - We are continuing to investigate an issue currently impacting the US environment and resulting in intermittent or slow page loads when accessing the Obsidian UI. At this time, all other environments remain operational and unaffected. Our engineering team is actively working to isolate the underlying root cause and mitigate impact. We will provide a further update in 1 hour, or sooner, as more information becomes available. Thank you for your patience while we work to restore normal operation. Feb <var data-var='date'> 9</var>, <var data-var='time'>13:06</var> PST Investigating - We are currently investing an issue resulting in intermittent issues loading the Obsidian admin console and modules within.

Intermittent failures when loading Obsidian admin console

Feb <var data-var='date'> 9</var>, <var data-var='time'>11:00</var> PST Resolved - We see US region got UI response slowness. Team identified it related to a backend issue. A fix was applied. The issue is resolved at 11:20AM

Web UI slowness for US region

Jan <var data-var='date'>19</var>, <var data-var='time'>01:00</var> PST Completed - The scheduled maintenance has been completed. Jan <var data-var='date'>18</var>, <var data-var='time'>21:00</var> PST In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Jan <var data-var='date'> 8</var>, <var data-var='time'>16:47</var> PST Scheduled - We will be undergoing scheduled maintenance during this time.

Infrastructure component upgrade for US region

Jan <var data-var='date'> 5</var>, <var data-var='time'>05:04</var> PST Resolved - After monitoring system performance and fully confirming the previously deployed fix to be effective, we are now marking this incident as resolved. All affected functionality has been fully restored, and customers should no longer encounter "An error has occurred" when loading these modules. Thank you for your patience while we worked through and resolved this incident. Jan <var data-var='date'> 4</var>, <var data-var='time'>22:35</var> PST Monitoring - A fix has been implemented and we are monitoring the results. Jan <var data-var='date'> 4</var>, <var data-var='time'>21:27</var> PST Update - We have identified the root cause of the issue impacting the threat, activity, dashboards, and objects modules in the US region and are currently implementing a fix. Impacted customers may still encounter "An error has occurred" when loading these modules while the fix is being rolled out. We will provide another update once the deployment is complete and we have validated full restoration of service. Jan <var data-var='date'> 4</var>, <var data-var='time'>18:30</var> PST Update - Update to Scope of Impact: Our ongoing investigation into this issue and identification of cause has resulted in a clarification on the scope of impact. Impact resulting from this issue is now scoped to the threat, activity, dashboards, and objects modules, including APIs underlying these modules Impacted customers will encounter "An error has occurred" error upon attempt to load these impacted modules. Our engineering team is currently working to address the underlying issue, and any updates will be posted on this incident notification. Jan <var data-var='date'> 4</var>, <var data-var='time'>18:26</var> PST Identified - Update to Scope of Impact: Our ongoing investigation into this issue and identification of cause has resulted in a clarification on the scope of impact. Impact resulting from this issue is now scoped to the threat and activity modules, including APIs underlying these modules Impacted customers will encounter "An error has occurred" error upon attempt to load these impacted modules. Our engineering team is currently working to address the underlying issue, and any updates will be posted on this incident notification. Jan <var data-var='date'> 4</var>, <var data-var='time'>17:46</var> PST Update - We are continuing to investigate this issue. Jan <var data-var='date'> 4</var>, <var data-var='time'>17:44</var> PST Investigating - Our systems have detected an issue impacting threat that may result in "No Data" being displayed for a subset of settings. Our engineering team is currently working to address the underlying issue, and any updates will be posted on this incident notification.

Service partially down(threat, activity) for US region

Dec <var data-var='date'> 5</var>, <var data-var='time'>01:22</var> PST Resolved - This incident has been resolved. Our monitoring is no longer showing elevated error rates and all components across the Obsidian platform are fully operational. Dec <var data-var='date'> 5</var>, <var data-var='time'>01:07</var> PST Investigating - Obsidian is aware of and tracking the widespread issues with Cloudflare which may be impacting access to the Administration UI. We will post additional updates as we learn of recovery and next steps.

Obsidian Administration UI Access - Cloudflare Outage

Nov <var data-var='date'>18</var>, <var data-var='time'>10:27</var> PST Resolved - This incident has been resolved. Our monitoring is no longer showing elevated error rates and all components across the Obsidian platform are fully operational. Nov <var data-var='date'>18</var>, <var data-var='time'>09:39</var> PST Monitoring - Following additional mitigation efforts by the Cloudflare team, our monitoring and telemetry reflect a return to normal error rates across the Obsidian platform. Obsidian will continue monitoring this incident to ensure full resolution. Nov <var data-var='date'>18</var>, <var data-var='time'>07:47</var> PST Identified - On-going monitoring following a fix applied by Cloudflare indicate a continuation of intermittent issues accessing the Administration UI. Additional mitigation efforts are underway and further updates will be provided as those efforts progress. Nov <var data-var='date'>18</var>, <var data-var='time'>06:53</var> PST Monitoring - Cloudflare has implemented a fix and we are now observing a return to normal operation of the Administration UI. Obsidian will continue monitoring this incident to ensure full resolution. Nov <var data-var='date'>18</var>, <var data-var='time'>04:16</var> PST Identified - Obsidian is aware of and tracking the widespread issues with Cloudflare which may be impacting access to the Administration UI. We will post additional updates as we learn of recovery and next steps.

Nov <var data-var='date'>13</var>, <var data-var='time'>06:56</var> PST Resolved - This incident has been resolved. We have released a permanent fix in the Obsidian Browser Extension version ver. 1.13.4, which is now rolling out via auto‑update. What to expect: The updated extension will install automatically as it propagates to users. Next steps: If you previously disabled Phishing Detections as a workaround, you may re‑enable it once your environment has received version 1.13.4. Scope: No other Browser Extension capabilities were affected. Support: For help confirming rollout status or re‑enabling Phishing Detections, contact Obsidian Support at support@obsidiansecurity.com or your Technical Account Manager. Thank you for your patience while we worked to resolve this issue. Nov <var data-var='date'>12</var>, <var data-var='time'>17:14</var> PST Identified - A root cause has been identified for the issue impacting the Obsidian Browser extension that is resulting in a subset of customers experiencing browser performance degradation when the Obsidian Browser Extension analyzes certain pages for Phishing Detections. Scope and impact Issue onset has been observed with ver. 1.13.x and up Other Browser Extension capabilities remain unaffected. Temporary mitigation (workaround) Administrators can temporarily disable the Phishing Detections component to prevent the behavior while a permanent fix is prepared. How to apply the workaround Sign in to the Obsidian admin console, then open Browser Extension settings. Locate Phishing Detections and set the Phishing Status to “Disabled.” Save changes, wait a few minutes for propagation, then refresh affected browsers. Next steps A new extension version with a permanent fix is being prepared and will roll out via auto‑upgrade. After the fixed version is deployed in your environment, re‑enable Phishing Detections to restore full protection. Support For assistance determining whether to apply this mitigation, contact Obsidian Support at support@obsidiansecurity.com or your Technical Account Manager. Nov <var data-var='date'>12</var>, <var data-var='time'>11:12</var> PST Investigating - We are currently investigating reports from a subset of customers reporting page unresponsive messages for a subset of webpages under Google Chrome and Microsoft edge when running version 1.13.x of the Obsidian browser extension. Additional updates will be posted on this incident notification as our investigation into the root cause of this issue progresses

Obsidian Browser Extension ver. 1.13.x Page Unresponsive Errors

Nov <var data-var='date'> 6</var>, <var data-var='time'>11:39</var> PST Resolved - This issue has been resolved. A fix addressing the underlying issue was implemented and authentication services have returned to normal operation. Nov <var data-var='date'> 6</var>, <var data-var='time'>11:35</var> PST Identified - The issue has been identified and a fix is being implemented. Nov <var data-var='date'> 6</var>, <var data-var='time'>11:35</var> PST Update - We have identified the root cause of the issue resulting in users encountering a "No access granted" error when attempting to authenticate to the Obsidian platform, and are in the process of taking mitigation actions. Additional updates will be posted on this incident notification. Nov <var data-var='date'> 6</var>, <var data-var='time'>11:03</var> PST Investigating - We are currently investigating an issue with our Admin portal authentication service which might prevent users from successfully authenticating to the Obsidian platform. Impacted users will encounter an error indicating "No access granted" when attempting to authenticate. Our teams are currently investigating the issue and any updates will be posted on this incident notification.

Errors when authenticating to the Obsidian admin portal

Aug <var data-var='date'>28</var>, <var data-var='time'>16:05</var> PDT Resolved - The issue has been resolved and impacted Salesforce posture rules now reflect the correct status. We appreciate your patience and understanding during this time, and if you experience any further issues, please do not hesitate to reach out. Aug <var data-var='date'>28</var>, <var data-var='time'>09:06</var> PDT Identified - We have identified an issue impacting a subset of Salesforce posture rules. Impacted customers may find that the rule IDs noted below will have unexpectedly moved from a failing to passing state. In the course of addressing the underlying cause, and rules being reverted to their proper state, posture drift alerts may be received. Environments Impacted: US, EU, AU SalesforceInactivePrivilegedAccounts SalesforceSystemAdmins SalesforcePrivilegedUsersFromLowReputationDomains SalesforceGhostAdmins SalesforceUsersWithCreatePublicLinks SalesforceWeakerProfilePasswordSettings SalesforceExternalUserObjectAccess SalesforceUsersWaivedMFA SalesforceGuestUserObjectAccess SalesforceUsersNoMFA SalesforceIntegrationUsersWithSysAdminProfile SalesforceRiskyGuestUsers SalesforceFieldLevelAccessForEncryptedData SalesforceWeakerProfileSessionSettings SalesforceFieldLevelAccessForComplianceData SalesforceAppsExcessivePermissions Additional updates will be provided via this posting as our investigation progresses and the issue is mitigated.

Subset of Salesforce posture rule unexpectedly changed to passing

Aug <var data-var='date'> 7</var>, <var data-var='time'>09:22</var> PDT Resolved - This incident has been resolved. Fixes addressing UI visibility for threat alerts and historical activity data have each been deployed, and post fix validation confirms each to have been fully mitigated. Aug <var data-var='date'> 6</var>, <var data-var='time'>16:07</var> PDT Update - The scope of impact for this issue has been updated: A fix for the issue resulting in threat alerts not being visible within the administrator UI threat module has been deployed and verified. During the process of development and deployment, it was additionally found that for a subset for customers within our US environment, a subset of historical activity is not visible within the activity module. The impact of this secondary issue is isolated solely to the ability for the underlying data to be displayed within the UI, with no interruption to threat detections or action policies. A fix for this secondary issue is being prepared and tested, and further updates will be provided once it has been fully deployed and issue mitigation validated. Aug <var data-var='date'> 6</var>, <var data-var='time'>12:53</var> PDT Identified - We have identified the cause of the underlying issue resulting in alerts not being visible within the administrator UI threat module, and are currently implementing a fix. Further updates will be provided once the fix has been fully deployed and issue mitigation validated. Aug <var data-var='date'> 6</var>, <var data-var='time'>07:48</var> PDT Investigating - We are are currently investigating an issue resulting in threat alerts not being visible within the administrator UI threat module. Our teams are actively working to resolve the issue, and we'll provide updates on this incident as they become available.

Threat alerts and a subset of historical activity not visible within administrator UI

Jul <var data-var='date'>18</var>, <var data-var='time'>14:31</var> PDT Resolved - This incident has been resolved. Actions to mitigate the conditions resulting in lag on streaming detections within the US environment have been taken and telemetry has confirmed the issue to been fully mitigated. Jul <var data-var='date'>17</var>, <var data-var='time'>12:13</var> PDT Investigating - Our monitoring has identified an issue within our US environment resulting in increased lag on streaming detections for a subset of customers. While no direct impact has been identified at this time, there is the possibility that alerts resulting from detections designated as streaming might be delayed as time progresses. We will post additional updates as we continue our investigation and mitigation efforts.

Is Obsidian Security down?

Obsidian Security status is UP

Lastest published events

Security Advisory: CloudSEK Disclosure - TeamPCP / Trivy Supply Chain Campaign

Database maintenance in EU region

[US Region] - Delayed Identity-Centric Alerts

Obsidian Security Services, Components and Regions

Recent Obsidian Security events

Security Advisory: CloudSEK Disclosure - TeamPCP / Trivy Supply Chain Campaign

Database maintenance in EU region

[US Region] - Delayed Identity-Centric Alerts

[US Region] - Subset of Alerts Delayed

Infrastructure component upgrade for EU region

Infrastructure component upgrade for EU region