Investigating – Security incident affecting customer portals and API access

We identified unauthorised activity on part of our infrastructure on 8 November and have taken affected services offline as a precaution while we investigate and rotate credentials. The Control Panel has been restored. Customer Portals remain temporarily unavailable. As part of our response, API keys and sessions have been revoked: if your integration receives authentication errors, please generate a new API key from the Control Panel. We will provide further updates as our investigation progresses.

We are carrying out security hardening across the platform. While this is in progress:

• Customer-portal self-registration and password reset are temporarily disabled. Contact support to reset access.
• ScriptForge: scripts must use API tokens (cxo…). Email-based cxRest.auth() and cxUserspace are no longer supported. Legacy ScriptForge is temporarily unavailable.
• Some IP ranges and VPN services may be blocked from the control panel and portals. If you're affected, contact support with your IP.

Calls and routing are not affected. We'll update this notice as features are restored.