Tell HN: Unbounce Security Incident
We detected a security event that began on or about October 14, 2026 that may have resulted in the exposure of keys for Unbounce’s integration with third party applications. You are receiving this notice because your former Unbounce account was connected to one or more of these applications.
We are actively investigating this issue with the assistance of third-party security experts. We currently have no evidence of any misuse of the integration keys. Because your Unbounce account is no longer active, no action is needed within Unbounce. However, we strongly recommend that you immediately take the steps outlined below in any third-party applications you previously connected to Unbounce:
Customers with integration to Mailchimp: Customers should first disconnect Unbounce in Mailchimp under Integrations → Manage → Other connections, and regenerate any Mailchimp API key they created for Unbounce. Customers should review activity in their Mailchimp account since October 14 to identify any suspicious activity associated with the Unbounce integration.
Customers with integration to HubSpot: Unbounce rotated the integration keys for HubSpot integrations on October 20. Customers should review activity in their HubSpot instance between October 14 and October 20 to identify any suspicious activity associated with the Unbounce integration.
Customers with integration to Salesforce: On October 22, Unbounce rotated the credentials for its Salesforce connected app, which disconnected all existing Salesforce connections. We recommend that customers revoke the previous Unbounce connected app in Salesforce Setup → Connected Apps OAuth Usage. Customers should review activity in their Salesforce instance since October 14 to identify any suspicious activity associated with the Unbounce integration.
Customers with integration to AWeber: On October 22, Unbounce rotated its AWeber app credentials, which disconnected all existing AWeber connections. Customers should review activity in their AWeber account since October 14 to identify any suspicious activity associated with the Unbounce integration.
Customers with integrations to Marketo, Keap (Infusionsoft), Insightly, or Campaign Monitor: These integrations use API credentials that belong to the customer, so Unbounce cannot rotate them. Customers should generate new credentials in the vendor’s application and deactivate the credentials previously used with Unbounce. Customers should review activity in their instances for these applications since October 14 to identify any suspicious activity associated with the Unbounce integration.
Customers who have connected Zapier to Unbounce: Zapier connects to Unbounce through Unbounce’s API using OAuth. On October 22, Unbounce revoked all existing tokens for these connections. No further action is needed. Customers may remove Unbounce from My Apps in Zapier.
Customers who have connected other applications to Unbounce: Some other applications also connect to Unbounce through Unbounce’s API using OAuth. On October 22, Unbounce revoked all existing tokens for these connections. No further action is needed.
Customers who use the Unbounce WordPress plugin: The Unbounce WordPress plugin connects to Unbounce through Unbounce’s API using OAuth. On October 22, Unbounce revoked all existing tokens for the plugin. No further action is needed. Customers may deactivate and remove the plugin in WordPress admin.
Customers who have used an API key: No action is needed within Unbounce.
For reference, legitimate traffic typically comes from 50.19.99.184, 63.186.16.150, 18.196.144.222, and 18.195.113.15 for our webhooks and integrations.
We understand that this is a frustration and we sincerely regret causing an interruption of your work. If you require further information, please visit this documentation.
Sincerely, The Unbounce Team