October 2026 Security incident update

First Update: October 27, 2026

On Friday, October 23, 2026, at 11:56am PDT, a vulnerability in Giftbit’s system was exploited by an attacker. The attacker discovered and exploited an access control vulnerability in one of our web application dashboards that allowed them to assume privileged access in our main web application. Giftbit detected this suspicious behavior at 12:19pm PDT. As soon as we spotted it, we took measures to contain the attack, while investigating the root of our system’s vulnerability. We fully patched the vulnerability at 5:16pm PDT.

This post covers what we know so far, what we’ve done about it, and what customers should look out for. We’re still investigating, so some of this may change as we learn more.

Where things stand as of October 27

• 8 reward recipient email addresses were exposed. We are in direct contact with the customers affected.
• For all other customers, we have found no indication that any recipient emails were exposed.
• We have no evidence that customer account balances or reward issuances have been affected by the attack.
• To date, we have found no indication that payment card data, bank account details, or account passwords were part of the access.
• We continue to investigate the attack and involved our security consultant and an external incident response team.

Timeline (October 23, 2026, Pacific Time)

• 11:56am: The vulnerability is first exploited.
• 12:19pm: Our team detects the activity.
• 12:20pm: The incident is escalated to the full response team, including people at our external security vendor.
• 5:16pm: Giftbit deploys a configuration patch to solve the root issue.

Correction: Our October 26 email to customers incorrectly reported that we detected the unauthorized access within one minute. The timeline above is correct.

What happened

A setting in how we configure internal, administrative accounts in our web application was vulnerable. The vulnerability allowed the attacker to gain access to internal admin web tools, which are used for customer, recipient, and supplier management.

Giftbit logs critical system activity so we were able to track what web pages (and associated data) the attacker accessed.

Our investigation to date indicates this incident did not involve remote code execution. It is unrelated to PHP2Shell, the PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that the PHP project patched on October 21. Giftbit does not use PHP in its systems.

What information may have been involved

Our web-based admin panel shows basic customer account and reward information. Here’s what we found the attacker viewed:

• Customer account details: account names and account email addresses.
• Reward details: 500 rewards in total, 128 of them unclaimed and 372 already redeemed.
• Recipient email addresses: 8 addresses, belonging to people who received rewards from 7 customers.

We’ve contacted every affected customer directly. For the unclaimed rewards, we’re working with each customer to cancel, refund, and reissue them.

We have no evidence that any of this information has been misused.

What we’ve done

• Shut off the attacker’s access and fixed the problem that let them in.
• Brought in our security and compliance team, company leadership, our security provider, and an outside team that specializes in investigating security incidents.
• Contacted every customer whose rewards were viewed, to coordinate cancelling, refunding, and reissuing them.
• Emailed customers affected by those cancellations on October 24, and emailed all customers on October 26.
• Contacted each customer whose reward recipients’ email addresses were seen.

What to watch for

Information like a company name and email address can be used for targeted phishing, such as emails or calls pretending to be Giftbit. Be cautious of unexpected requests to change payment details, send funds, log in through an unfamiliar link, or share credentials. Giftbit will never ask for your password. If something looks like it’s from us and you’re unsure, contact security@giftbit.com before acting.

What’s next

Our investigation is ongoing. We’ll publish further updates as new, dated posts on this page. If our assessment changes in a way that affects customers, we’ll also contact those customers directly.

Questions can go to security@giftbit.com at any time.

New updates will be posted here.

FAQ

What caused the breach?

The attacker found a weakness in one of our web dashboards that let them give themselves administrator-level access to our main application.

When did it happen?

(October 23, 2026, Pacific Time)

• • 11:56am The vulnerability is first exploited.
  • 12:19pm Our team detects the activity.
  • 12:20pm The incident is escalated to the full response team.
  • 5:16pm: Giftbit deploys a configuration patch to solve the root issue.

What data types were impacted?

Customer account name, customer account email, reward details (128 unclaimed rewards & 372 redeemed rewards), internal supply-management metrics, 8 recipient email addresses.

How did you stop the attack?

As soon as we spotted the attack, we blocked the attacker’s IP addresses and signed out everyone using Giftbit at the time. While we worked on a permanent fix, the attacker kept creating new accounts to try again, so our team watched for this and shut those attempts down manually. We found the underlying problem and fixed it that same afternoon.