Amplitude discloses event-data exposure affecting fewer than 0.3% of customer accounts
Amplitude confirms unauthorized internal-system access affected event data for fewer than 0.3% of customer accounts. It says it contained the September 28 incident and contacted affected customers; exposed fields and a person count remain undisclosed.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Amplitude customers whose event data was in the affected internal systems; vendor notifications determine scope
- Amplitude · analytics · data breach
- In the wild
- Yes
- Amplitude confirms unauthorized access, rather than only a theoretical vulnerability.
What happened
Amplitude separates this incident from the recent PHP and Node.js vulnerabilities. It reports independent forensic support and says its other customers’ end-user information was not exposed. The access mechanism and attacker remain unspecified. L3 reflects confirmed exposure at a mainstream analytics service, without evidence establishing a mass leak or an affected-person total.
Crime-scene timeline
Sep 28, 2026
Amplitude says it detected and contained unauthorized access
Oct 28, 2026
Customer update publishes the event-data scope
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.