# Joplin Cloud security incident — 24 October 2026

**URL:** <https://discourse.joplinapp.org/t/joplin-cloud-security-incident-24-october-2026/51289>\
**Category:** News\
**Created:** [24 October 2026 23:45 UTC](https://discourse.joplinapp.org/t/joplin-cloud-security-incident-24-october-2026/51289 "2026-10-24T23:45:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![laurent](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@laurent](https://discourse.joplinapp.org/u/laurent)\
**Post date:** [24 October 2026 23:45 UTC](https://discourse.joplinapp.org/t/joplin-cloud-security-incident-24-october-2026/51289/1 "2026-10-24T23:45:54Z")

</div>

On 24 October we discovered that someone had gained access to a small number of Joplin Cloud accounts by exploiting a flaw in our subscription checkout process. The flaw allowed them to sign in to an account without knowing its password.

**Eleven accounts were affected.** We will contact all eleven directly. If you have not received an email from us, your account was not affected.

We took Joplin Cloud offline the same day while we investigated. We have since fixed the flaw, removed the attacker's access, and reset the passwords on the affected accounts. The service is back online.

A few points worth stating clearly:

- **Notes protected by end-to-end encryption were not readable.** On the affected accounts that had E2EE enabled, no note content was obtained.
- **Accounts without end-to-end encryption were readable** while the attacker had access, and on two of them notes and attachments were downloaded. Those users have been told specifically what was taken.
- **No payment details were affected.** Card details are held by Stripe, never by us, and our Stripe account was not compromised.
- **No notes were deleted or modified** , apart from a few test files created on one account, which that user has been told about.

We reviewed every account confirmation for the past two months, so we are confident about the number affected and that it was limited to 24 October.

If you are not one of the eleven, there is nothing you need to do. If you would like to reduce your exposure in general, enabling end-to-end encryption is the single most effective step — it is what protected most of the affected accounts here.

We will publish more detail once the remaining work is complete.

If you have questions, feel free to contact us or reply on this thread.

---

<div class="post-metadata">

**Author:** ![laurent](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@laurent](https://discourse.joplinapp.org/u/laurent)\
**Post date:** [24 October 2026 23:46 UTC](https://discourse.joplinapp.org/t/joplin-cloud-security-incident-24-october-2026/51289/2 "2026-10-24T23:46:11Z")

</div>