Security incident: 4–6 October 2026

Last updated: 3 November 2026

Update, 3 November 2026: API keys

On 3 November we found a third-party website separating audio through our API with a key that was copied during this incident. We have revoked that key. Because the attacker could read every API key stored at the time, we are now replacing all keys that have not been regenerated since.

• If you use the API: open the API page, click regenerate, and put the new key into every script or app that uses it. Keys that have not been regenerated by 10 November 2026 will be reset automatically; from then on the old key stops working and the new one can be fetched from the same page.
• If you use the mobile app: nothing to do. The app receives a new key the next time you sign in.
• If you do not use the API: nothing to do. Your key will be replaced automatically and you will not notice.

Credits, results and settings are not affected. We are emailing everyone who has used the API in the last three months; the email links to this page and asks for nothing except that you regenerate your key on mvsep.com itself.

Between 4 and 6 October 2026 an attacker got into our servers and could read our database and the files stored on them. We have closed the hole they used, cut off their access and replaced the keys and passwords our service relies on. This page explains what happened, what information was involved and what you should do. All times are UTC.

What happened

The attacker exploited a flaw in how our website read one of its browser cookies. It let them run commands on our web server. From there they found the login details of our other servers and used them to sign in to those servers as an administrator. The database outage on 5 October was part of this: the attacker restarted our database.

• 4 October: automated probing of our website from the attacker's address begins.
• 5 October, about 01:30: the attacker first runs commands on our web server, then signs in to our other servers.
• 6 October, 03:25: the flaw is fixed on all our servers.
• 6 October: the attacker's access is removed, servers are switched to key-only logins, and the site's keys and passwords are replaced.

What information was involved

The attacker could read our database and the files on our servers, so we are treating all of it as exposed:

• Account details: name, email address, how you sign in (password, Google or GitHub), plan, credit balance and account settings.
• Passwords: we never store them in readable form, only as salted bcrypt hashes. A hash cannot be turned back into the password, but a short or common password can still be guessed by trying candidates against it.
• API keys: these were stored as they are, so anyone holding a copy can use your key until you replace it.
• Processing history: names of the files you uploaded, the models and settings you chose, transcriptions, the IP addresses jobs came from and API webhook URLs.
• Audio files: uploads and results that were on our servers at the time. We normally delete them after about three days.
• Payment records: amounts, dates, credits bought and the payment provider's transaction ID. Card details are entered on Paddle's and YooKassa's own payment pages and never reach our servers.
• Support tickets and the messages in them.
• Google Drive and Yandex Disk connections: the tokens that let us save results to your cloud storage. We have replaced the credentials those tokens depend on, so a copy of them no longer works.

What we have done

• Fixed the flaw on all our servers.
• Removed the attacker's access and switched our servers to key-only logins.
• Replaced the site's encryption key, our database passwords, our payment-provider keys and our Google, GitHub, Google Drive and Yandex Disk credentials.
• Signed out every saved "Remember me" login, so you may need to sign in again.
• We are still reviewing logs and hardening our systems, and will update this page if we learn more.

What you should do

1. If you used your MVSEP password on any other site, change it there. You can also change it in your profile, or with a reset link.
2. If you use the API, create a new key on the API page and update your scripts. Your old key keeps working until you do, or until the automatic reset on 10 November 2026 (see the update above).
3. If you connected Yandex Disk, you may need to connect it again. You can review which apps can reach your files in your Google and Yandex account settings.
4. Be careful with emails that claim to be from MVSEP and ask for your password or a payment. We never ask for your password.

Questions

Write to us through support. We are sorry this happened.