--- title: "Stitch member profile and private-message incident" description: "Stitch reported access to some member profiles and final private messages, including information retained after account closure." incident_type: "Data incident" status: "active" last_modified: "2026-10-20" canonical_url: "https://www.ally.security/incidents/stitch-member-profile-message-incident-2026" markdown_url: "https://www.ally.security/incidents/stitch-member-profile-message-incident-2026.md" stix_url: "https://www.ally.security/incidents/stitch-member-profile-message-incident-2026/stix.json" --- # Stitch member profile and private-message incident Member profiles and private messages were accessed during attacks on Stitch. Last modified Oct 20, 2026 · 2 sources ## Summary - **Environment:** Stitch community profiles and private messaging - **Operational impact:** Some profile and message information accessed - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [Stitch](https://www.stitch.net/) reported sustained attacks that exposed information about some members. Its [sample notice](https://oag.ca.gov/system/files/Email%20Sample.pdf) confirms that information retained after account closure was included. [1](#source-1) ## Impact Attackers accessed the last private message exchanged between certain members and profile fields that could include first name, photos, biography, interests, suburb, preferences and account status. [1](#source-1) Stitch said passwords, payment-card information, and account-associated email addresses and phone numbers were not accessed. Information written inside messages has a different scope. [1](#source-1) ## Timeline ### October 18, 2026 — California report recorded The [registry](https://oag.ca.gov/privacy/databreach/list) lists September 18 as the reported breach date. The undated email gives relative timing rather than an exact intrusion timestamp. [2](#source-2) ### October 20, 2026 — Briefing updated This briefing was last reviewed and updated on October 20, 2026. ## Threat Group & Attack Vector The notice does not establish a specific exploit or attacker identity. ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response Stitch said it blocked the attacker, removed malicious accounts and closed the entry route. It reviewed messages automatically and alerted members whose messages might contain contact, health or financial details or a photo. The sample recipient’s messages were not found to contain those details. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Stitch member profile and message breach notification official · Stitch Connect Inc ### Data Security Breach List — 2026 records regulatory · California Department of Justice, Office of the Attorney General
Evidence ledger Review the supporting structured claims. 1. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Photographic images 2. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: Attackers accessed the last private message exchanged between certain members. 3. **Occurred At · 100% confidence · current** California report recorded: 2026-10-18 4. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Message content 5. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: Stitch automatically reviewed messages and alerted members whose messages might contain contact, health or financial information or a photo. The sample recipient’s messages were not found to contain those details. 6. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: Stitch said it blocked the attacker, removed malicious accounts and closed the route used to enter. 7. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: Stitch said passwords and credit-card information were not accessed, and that account-associated email addresses and phone numbers were not accessed; contact details inside messages are a different scope. 8. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: Stitch reported sustained attacks and access to information about a small percentage of members; this wording is not a numerical population estimate. 9. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: California lists September 18, 2026 as the reported breach date; the undated sample email describes relative days without a precise intrusion timestamp. 10. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: Profile information could include first name, photos, biography, interests, suburb, preferences and account status. 11. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: Information retained after account closure was included in the affected records. 12. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Names 13. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: Personal information described in the notification 14. **Resulted In · 100% confidence · current** Stitch member profile and private-message breach: California report recorded 15. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Geographic location information 16. **Affected Organization · 100% confidence · current** Stitch member profile and private-message breach: Stitch Connect Inc