Thycotic incident
Platform: Slow logins and login failures on Delinea Platform (EU, UK, SEA and AU)
Resolved after 32 minutes, affecting Platform and Platform and 1 more, on September 29, 2026.
## Incident Overview Delinea Platform users in the EU, UK, Southeast Asia, and Australia regions experienced very slow logins and intermittent login failures. Affected functionality included Entra ID single sign-on, local account authentication, and Privileged Remote Access \(PRA\) session establishment. * Start: September 28, 2026, approximately 11:20 PM UTC * End: September 29, 2026, approximately 01:10 AM UTC ## Root Cause and Remediation A scheduled deployment introduced the use of regional cache replicas to improve authentication performance. Pre-release validation confirmed the replicas were active, but a firewall configuration error prevented data synchronization between the primary cache and the regional replicas. The cloud provider's standard health reporting continued to show the replicas as healthy and available, so the issue was not surfaced before or during the release. When the authentication service attempted to read from these replicas, requests stalled and timed out, resulting in login failures. Internal monitoring detected the elevated error rates, and the engineering team identified the root cause and rolled back the change. The rollback returned all affected regions to the primary cache and restored normal authentication. Regional cache replicas will remain disabled for the EU, UK, Southeast Asia, and Australia regions while we evaluate alternative architectures. We assessed private network connectivity between caches and determined it does not meet our reliability requirements. ## Preventive Actions * We are making significant improvements to how the authentication service recovers from cache connectivity problems. The goal is that a degraded cache connection no longer causes stalled or failed logins. * We have added alternate monitoring for connection failures, giving earlier detection of cache related issues that are not reflected in the cloud provider's health reporting. We apologize for the disruption and are committed to preventing recurrence through these measures.
Affected components
Update timeline
- identified Sep 29, 2026, 01:02 AM UTC
We are investigating reports of slow logins and intermittent login failures for Delinea Platform customers in the EU, UK, Southeast Asia, and Australia regions. Starting at approximately 23:20 UTC on September 28, 2026, some users may take much longer than usual to sign in. Some sign-in attempts may fail with a timeout or HTTP 504 error. Users who are already signed in may also see slower responses when their session is validated. Our engineering team is actively engaged and has identified a degraded dependency affecting the authentication service in these regions. We are working on mitigation now. If a sign-in fails, please retry. We will post another update within 30 minutes, or sooner if we have new information.
- identified Sep 29, 2026, 01:14 AM UTC
We have applied a fix for customers in the EU and Australia regions. Sign-in performance and error rates in these regions have returned to normal as of approximately 01:05 UTC on September 29, 2026. We are monitoring to confirm the recovery holds.
- monitoring Sep 29, 2026, 01:19 AM UTC
We have applied a fix for all affected regions: EU, UK, Southeast Asia, and Australia. Sign-in performance and error rates have returned to normal as of approximately 01:10 UTC on September 29, 2026. We are monitoring to confirm the recovery holds. If you still have trouble signing in, please refresh your browser and try again. If the problem continues, contact Delinea Support.
- resolved Sep 29, 2026, 01:35 AM UTC
This incident has been resolved.
- postmortem Oct 06, 2026, 01:00 AM UTC
## Incident Overview Delinea Platform users in the EU, UK, Southeast Asia, and Australia regions experienced very slow logins and intermittent login failures. Affected functionality included Entra ID single sign-on, local account authentication, and Privileged Remote Access \(PRA\) session establishment. * Start: September 28, 2026, approximately 11:20 PM UTC * End: September 29, 2026, approximately 01:10 AM UTC ## Root Cause and Remediation A scheduled deployment introduced the use of regional cache replicas to improve authentication performance. Pre-release validation confirmed the replicas were active, but a firewall configuration error prevented data synchronization between the primary cache and the regional replicas. The cloud provider's standard health reporting continued to show the replicas as healthy and available, so the issue was not surfaced before or during the release. When the authentication service attempted to read from these replicas, requests stalled and timed out, resulting in login failures. Internal monitoring detected the elevated error rates, and the engineering team identified the root cause and rolled back the change. The rollback returned all affected regions to the primary cache and restored normal authentication. Regional cache replicas will remain disabled for the EU, UK, Southeast Asia, and Australia regions while we evaluate alternative architectures. We assessed private network connectivity between caches and determined it does not meet our reliability requirements. ## Preventive Actions * We are making significant improvements to how the authentication service recovers from cache connectivity problems. The goal is that a degraded cache connection no longer causes stalled or failed logins. * We have added alternate monitoring for connection failures, giving earlier detection of cache related issues that are not reflected in the cloud provider's health reporting. We apologize for the disruption and are committed to preventing recurrence through these measures.
Your product runs on more than Thycotic
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.