Incident debrief: Mender email invitations abused for spam emails

On Oct 23rd 2026, from 13:45 to 15:01 UTC, our hosted Mender production instance was abused to send spam emails. It took us 1 hour and 16 minutes to detect the problem, disable email sending, find the offending user and suspend them to stop the abuse.

The spammer used Mender as a spam email service - they brought their own message and list of email addresses to send to. Mender users were not compromised or targeted or affected (aside from us turning off email sending for about 1 hour while handling the issue).

Timeline

Description

The spammer put a long text inside their Mender organization name, with content intended to make the target call a US-based phone number, and started inviting users to this organization. This resulted in the invited users receiving an email like this:

While it looks quite strange and not very convincing, it is possible that some small fraction of the users targeted by this might be tricked. The malicious actor attempted to invite 26 000 email addresses in this manner. A majority of the emails bounced or failed - around 8 000 emails succeeded. In our testing, we found that common email service providers like gmail.com does (correctly) mark this as spam - so the email above might go directly to the user's spam folder, and not be seen at all.

Follow-ups

Following the incident we have performed several actions, including:

• Contacting the ~8 000 affected recipients, telling them to ignore the previously received email address and beware of similar spam / scam attempts in the future. Their email addresses were already in a list used by the spammers, so it is likely they might be targeted again by similar spam in the future.
• Reporting the US phone number and email address to the US FTC (Report Fraud service).
• Adding stricter rate limits to make similar kinds of abuse much slower and more limited.
• Adjusting email templates to limit what information can be put inside them by users for these kinds of malicious purposes.

We will review our monitoring and alerting systems and consider what else we can do to improve and avoid similar situations in the future. We apologize for any inconvenience or confusion this incident may have caused you.