---
title: "Amplitude internal-systems event-data incident"
description: "Amplitude disclosed unauthorized internal-system access affecting event data for less than 0.3% of customer accounts."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-30"
canonical_url: "https://www.ally.security/incidents/amplitude-internal-systems-event-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/amplitude-internal-systems-event-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/amplitude-internal-systems-event-data-incident-2026/stix.json"
---

# Amplitude internal-systems event-data incident

The company says it contained and remediated the September 28 access and contacted affected customers.

Last modified Oct 30, 2026 · 1 source

## Summary

- **Environment:** Localized portion of Amplitude internal systems
- **Operational impact:** No outage duration established in the security notice
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Amplitude](https://amplitude.com/) says it detected, contained and remediated unauthorized access to part of its internal systems on September 28, 2026. [1](#source-1)

## Impact

Event data belonging to less than 0.3% of customer accounts was affected. This is an account percentage, not an end-user count. Amplitude said no end-user information was exposed for its other customers. [1](#source-1)

## Timeline

### September 28, 2026 — Unauthorized access detected and remediated

Amplitude describes containment on the day of detection. [1](#source-1)

### October 28, 2026 — Customer security update published

The [Trust Center update](https://trust.amplitude.com/updates) explains the limited customer-account scope. [1](#source-1)

### October 30, 2026 — Briefing updated

This briefing was last reviewed and updated on October 30, 2026.

## Threat Group & Attack Vector

Amplitude did not identify the access method or actor. It explicitly separated this incident from the recent PHP and Node.js vulnerabilities discussed elsewhere in its Trust Center. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The company contacted affected customers and continued assessing impact with independent forensic support. Detailed exposed fields and an affected-person total remain undisclosed. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/amplitude-internal-systems-event-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Amplitude Trust Center updates

official · Amplitude

<https://trust.amplitude.com/updates>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Amplitude internal-systems event-data incident: Amplitude explicitly separated this incident from the recent PHP and Node.js vulnerabilities named in its notice; no initial-access mechanism or actor was disclosed.
2. **Resulted In · 100% confidence · current**  
   Amplitude internal-systems event-data incident: Customer security update published
3. **Discovered At · 100% confidence · current**  
   Amplitude internal-systems event-data incident: 2026-09-28
4. **Resulted In · 100% confidence · current**  
   Amplitude internal-systems event-data incident: The incident affected event data belonging to less than 0.3% of customer accounts. This percentage is not a count of end users or records.
5. **Resulted In · 100% confidence · current**  
   Amplitude internal-systems event-data incident: Unauthorized access detected and remediated
6. **Occurred At · 100% confidence · current**  
   Customer security update published: 2026-10-28
7. **Resulted In · 100% confidence · current**  
   Amplitude internal-systems event-data incident: Amplitude said it detected, contained and remediated unauthorized access to a localized portion of its internal systems on September 28, 2026.
8. **Occurred At · 100% confidence · current**  
   Unauthorized access detected and remediated: 2026-09-28
9. **Affected Organization · 100% confidence · current**  
   Amplitude internal-systems event-data incident: Amplitude
10. **Resulted In · 100% confidence · current**  
   Amplitude internal-systems event-data incident: Amplitude contacted affected customers and continued assessing impact with an independent forensics firm. It said no end-user information was exposed for its other customers.

</details>