Resolved -
We have now completed extensive testing of two-factor authentication and have re-enabled email sending within the app.
All users will continue to be required to log in again and complete one-time password verification by email as part of this security update. This change was implemented to strengthen account security and reduce the risk of similar abuse in the future.
If you have trouble receiving your two-factor authentication code by email, please contact support@shedsuite.com and our team can assist you with a recovery code.
We will continue monitoring closely, but at this time email functionality has been restored.
May 23, 15:08 EDT
Update -
We have successfully deployed two-factor authentication for all accounts and are now preparing to restore email sending within the app.
As part of this security update, all users will be required to log in again and complete a one-time password verification sent by email before regaining access. We implemented this change to strengthen account security and reduce the risk of this type of abuse recurring.
We are performing final validation now and expect to re-enable email functionality shortly. We will post another update as soon as email sending has been fully restored.
May 23, 13:59 EDT
Update -
We have updated the status of outbound emails for signature requests to reflect a complete outage while this functionality remains intentionally disabled as part of our security response. We are continuing remediation and preparing the weekend rollout of mandatory two-factor authentication for all accounts.
May 23, 11:54 EDT
Update -
We have temporarily disabled email sending from within the app while we respond to misuse of our email-sending endpoint by an internal user.
We have identified, isolated, and blocked all known malicious users involved. While that immediate threat has been contained, email-based actions and notifications from the app will remain temporarily unavailable as we complete additional security measures.
This weekend, we will roll out two-factor authentication for all accounts as part of that response. This update will log out all users and require a one-time password sent by email during login before access is restored. We are making this change to strengthen account security and help prevent this type of abuse from happening again.
At this time, we have no indication that customer data or payment systems were compromised through this specific issue. We will continue to post updates here as we complete remediation and work toward safely restoring in-app email functionality.
May 23, 11:53 EDT
Investigating -
We have temporarily disabled email sending from within the app while we respond to misuse of our email-sending endpoint by an internal user.
We have identified, isolated, and blocked all known malicious users involved. While that immediate threat has been contained, email-based actions and notifications from the app will remain temporarily unavailable as we complete additional security measures.
This weekend, we will roll out two-factor authentication for all accounts as part of that response. This update will log out all users and require a one-time password sent by email during login before access is restored. We are making this change to strengthen account security and help prevent this type of abuse from happening again.
At this time, we have no indication that customer data or payment systems were compromised through this specific issue. We will continue to post updates here as we complete remediation and work toward safely restoring in-app email functionality.
May 23, 11:51 EDT