Code 42 incident

Exfiltrated File Collection Disruption (Incydr Gov Only)

Resolved after 4 days 18 hours, on July 8, 2026.

postmortem Jul 20, 2026, 05:51 PM UTC

## Incydr Gov Only On July 8 2026 21:00UTC, the service cluster responsible for managing exfiltrated files in our Incydr Gov environment experienced an outage. During the outage, users were unable to download previously captured exfiltrated files from the Incydr console, and the Incydr agent was unable to upload newly captured files to the service. Alerts that rely on file content based risk indicators for exfiltrated file activity would not have been generated during this period. Mimecast Engineering identified and resolved the underlying issue on July 13, 2026, and confirmed the service was fully restored as of 15:00UTC We are reviewing Incydr agent behavior during extended service interruptions to ensure captured files are reliably retained and delivered once service is restored, and we are adding additional monitoring to detect this class of issue more quickly going forward. Please reach out to your Mimecast representative with any questions.

Started
Jul 08, 2026, 09:00 PM UTC
Resolved
Jul 13, 2026, 03:00 PM UTC
Duration
4d 18h
Detected by Pingoru
Jul 08, 2026, 09:00 PM UTC

Update timeline

  1. resolved Jul 13, 2026, 08:00 PM UTC

    Between July 8, 2026 and July 13, 2026, Incydr Gov experienced a disruption to the service responsible for collecting copies of exfiltrated files. During this period, customers may have encountered errors when attempting to view or download exfiltrated files, and alert rules dependent on content inspection risk indicators may not have generated alerts.

  2. postmortem Jul 20, 2026, 05:51 PM UTC

    ## Incydr Gov Only On July 8 2026 21:00UTC, the service cluster responsible for managing exfiltrated files in our Incydr Gov environment experienced an outage. During the outage, users were unable to download previously captured exfiltrated files from the Incydr console, and the Incydr agent was unable to upload newly captured files to the service. Alerts that rely on file content based risk indicators for exfiltrated file activity would not have been generated during this period. Mimecast Engineering identified and resolved the underlying issue on July 13, 2026, and confirmed the service was fully restored as of 15:00UTC We are reviewing Incydr agent behavior during extended service interruptions to ensure captured files are reliably retained and delivered once service is restored, and we are adding additional monitoring to detect this class of issue more quickly going forward. Please reach out to your Mimecast representative with any questions.

Your product runs on more than Code 42

Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.

Add your stack →