Lightning AI: unauthorized access to credentials forced the Studio platform offline
Severity: high · Patch status: partial · Since 2026-10-15
On 15 October 2026 at 23:00 UTC Lightning AI detected unauthorized access to credentials on the Lightning Platform, and at 01:00 UTC on 16 October revoked all user access to contain it. The incident affects the Studio-side services — Studio, Deployments, Pipelines and Drive — and not the GPU cluster rental infrastructure or managed Kubernetes and SLURM offerings. The company says customer credentials were abused to reach customer environments and third-party services connected to them; every credential it identified as used in the attack has been revoked, and keys tied to customer cloud accounts used on the platform were invalidated. The platform stayed inaccessible to all users while an external incident-response firm assisted, and potentially affected customers were notified with account-specific detail. The root cause, the number of affected accounts and what data was taken were not disclosed as of publication.
What to do
- If you used Lightning Studio, rotate every secret, API key and token stored in your Studios — GitHub credentials, cloud provider keys, model-provider keys, database passwords — from a machine outside the platform
- Rotate credentials for any third-party service your Lightning virtual machines could reach, then review that service's access logs for the incident window starting 15 October, 23:00 UTC
- Check your cloud providers for keys issued to or used from Lightning, disable them if the platform has not already, and audit billing and API activity for unusual calls
- Treat anything the compromised environments could read or exfiltrate as exposed, including source code, datasets and internal network access
- Watch for follow-on phishing and lateral attempts that use information taken from the platform
Sources
All live incidents on Threat Watch
