{"id":"INC-lightning-h20stxqvwg8r","kind":"incident","aliases":[],"related":[],"title":"Lightning AI: customer credentials compromised, Studio platform taken offline since Oct 16","description":"Read-only access to Drive is restored. More details here: https://lightning.ai/security-incident","summary":"Lightning AI identified unauthorized access to credentials on Oct 15 (23:00 UTC) and revoked all user access on Oct 16 01:00 UTC. The vendor believes certain customer credentials were compromised and used to reach environments and connected third-party services. Affected: Lightning Studio platform services (Studio, Deployments, Pipelines, Drive). Not affected per vendor: GPU cluster rental infrastructure, managed Kubernetes and SLURM. Read-only Drive access was restored Oct 28 via CLI (Lightning SDK required); Studio, Jobs and Deployments are not yet restored. An external firm is investigating.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Lightning AI","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["credential-compromise","hosted-service","incident","lightning","lightning-ai","security","vendor"],"not_affected_if":["gpu-cluster-rental-only","managed-kubernetes","no-lightning-ai-account","slurm"],"how_to_check":"You use Lightning Studio, Deployments, Pipelines or Drive: check whether Lightning AI emailed you account-specific information (the vendor says no notice means not identified as affected so far). Review access logs of GitHub, cloud accounts and any third-party services whose credentials were stored in your Studio environments or VMs, for activity since Oct 15.","fix":"No patch. Vendor recommends all users: rotate secrets, API keys and credentials stored in AI Studios (e.g. GitHub credentials); update credentials for third-party services accessed by your VMs; review third-party systems and access logs. Vendor has already revoked identified keys tied to your cloud accounts used on the platform.","status":"open","published_at":"2026-10-16T03:08:57+00:00","first_seen_at":"2026-11-08T16:58:25+00:00","triaged_at":"2026-11-08T16:59:11+00:00","updated_at":"2026-11-08T16:59:42+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-08T16:59:11Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Lightning AI: hosted service taken down during a security incident","impact":"medium","summary":"Lightning AI took its service offline while it investigates a security incident. Read-only access to Drive has been restored, and the sources do not say what data or accounts were exposed.","audience":"developers","category":"vendor","nicknames":[],"who_cares":["lightning-ai","hosted-service"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; the sources do not describe what was accessed","analyst_note":"Read https://lightning.ai/security-incident to learn what was accessed, which accounts or data were affected, and what customers should rotate or check.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-lightning-ai-account"],"who_is_affected":"Teams that use Lightning AI's hosted platform, including Drive storage, may have been affected by the service outage. The sources do not say whether customer data or credentials were exposed. Teams that do not use Lightning AI's hosted service can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":4472,"output_tokens":434,"severity_before":"critical","breached_checked":true},"analyst_status":"done","analyst_note":"Read https://lightning.ai/security-incident to learn what was accessed, which accounts or data were affected, and what customers should rotate or check.","search":"'/security-incident':136C '00':43B,54B '01':53B '15':41B '16':12A,52B '23':42B '28':104B 'access':36B,49B,100B,126C 'affect':75B,85B 'ai':2A,18A,29B,33B 'believ':58B 'certain':59B 'cli':106B 'cluster':89B 'compromis':5A,21B,63B 'connect':70B 'credenti':4A,20B,38B,61B 'credential-compromis':19B 'custom':3A,60B 'deploy':81B,113B 'detail':132C 'drive':83B,99B,128C 'environ':68B 'extern':119B 'firm':120B 'gpu':88B 'h20stxqvwg8r':16A 'host':23B 'hosted-servic':22B 'identifi':34B 'inc':14A 'inc-lightning-h20stxqvwg8r':13A 'incid':25B 'infrastructur':91B 'investig':122B 'job':111B 'kubernet':93B 'lightn':1A,26B,28B,32B,76B,107B 'lightning':15A,17A 'lightning-ai':27B 'lightning.ai':135C 'lightning.ai/security-incident':134C 'manag':92B 'oct':11A,40B,51B,103B 'offlin':9A 'parti':73B 'per':86B 'pipelin':82B 'platform':7A,78B 'reach':67B 'read':97B,124C 'read-on':96B,123C 'rental':90B 'requir':109B 'restor':102B,117B,130C 'revok':46B 'sdk':108B 'secur':30B 'servic':24B,74B,79B 'sinc':10A 'slurm':95B 'studio':6A,77B,80B,110B 'taken':8A 'third':72B 'third-parti':71B 'unauthor':35B 'use':65B 'user':48B 'utc':44B,55B 'vendor':31B,57B,87B 'via':105B 'yet':116B","nicknames":[],"mitigations":[],"who_affected":"Teams using Lightning Studio, Deployments, Pipelines or Drive. Anything stored as a secret or token in a Studio environment or reachable from its VMs (GitHub, cloud accounts) should be treated as exposed. Teams using only GPU cluster rental, managed Kubernetes or SLURM from Lightning are outside the stated scope.","tier":"C","verified":{"fix":{"at":"2026-11-08T16:59:42Z","by":"analyst","doc":"https://lightning.ai/security-incident","run_id":2194},"how_to_check":{"at":"2026-11-08T16:59:42Z","by":"analyst","doc":"https://lightning.ai/security-incident","run_id":2194},"who_affected":{"at":"2026-11-08T16:59:42Z","by":"analyst","doc":"https://lightning.ai/security-incident","run_id":2194}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ai","lightningai"],"ptokens":["ai","lightning"],"labels":["credentialcompromise","critical","hostedservice","incident","lightning","lightningai","security","vendor"],"campaign_type":null,"search_a":"'16':12A 'ai':2A,18A 'compromis':5A 'credenti':4A 'custom':3A 'h20stxqvwg8r':16A 'inc':14A 'inc-lightning-h20stxqvwg8r':13A 'lightn':1A 'lightning':15A,17A 'oct':11A 'offlin':9A 'platform':7A 'sinc':10A 'studio':6A 'taken':8A","search_b":"'00':43B,54B '01':53B '15':41B '16':52B '23':42B '28':104B 'access':36B,49B,100B 'affect':75B,85B 'ai':29B,33B 'believ':58B 'certain':59B 'cli':106B 'cluster':89B 'compromis':21B,63B 'connect':70B 'credenti':20B,38B,61B 'credential-compromis':19B 'custom':60B 'deploy':81B,113B 'drive':83B,99B 'environ':68B 'extern':119B 'firm':120B 'gpu':88B 'host':23B 'hosted-servic':22B 'identifi':34B 'incid':25B 'infrastructur':91B 'investig':122B 'job':111B 'kubernet':93B 'lightn':26B,28B,32B,76B,107B 'lightning-ai':27B 'manag':92B 'oct':40B,51B,103B 'parti':73B 'per':86B 'pipelin':82B 'platform':78B 'reach':67B 'read':97B 'read-on':96B 'rental':90B 'requir':109B 'restor':102B,117B 'revok':46B 'sdk':108B 'secur':30B 'servic':24B,74B,79B 'slurm':95B 'studio':77B,80B,110B 'third':72B 'third-parti':71B 'unauthor':35B 'use':65B 'user':48B 'utc':44B,55B 'vendor':31B,57B,87B 'via':105B 'yet':116B","search_c":"'/security-incident':136C 'access':126C 'detail':132C 'drive':128C 'lightning.ai':135C 'lightning.ai/security-incident':134C 'read':124C 'read-on':123C 'restor':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T03:08:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"lightning:h20stxqvwg8r","url":"https://stspg.io/j45j2k0cwnnz","severity":"critical","published_at":"2026-10-16T03:08:57+00:00","modified_at":"2026-10-29T15:57:37+00:00","first_seen_at":"2026-11-08T16:58:25+00:00","fetched_at":"2026-11-09T02:06:29+00:00","note":null},{"source":"analyst","external_id":"INC-lightning-h20stxqvwg8r:2194","url":"https://lightning.ai/security-incident","severity":null,"published_at":"2026-11-08T16:59:42+00:00","modified_at":"2026-11-08T16:59:42+00:00","first_seen_at":"2026-11-08T16:59:42+00:00","fetched_at":"2026-11-08T16:59:42+00:00","note":"Read vendor incident page and status page. Scope of data accessed not stated; exploitation details unknown; no mitigations. Rotation advice from vendor's own words.","cites":["https://lightning.ai/security-incident","https://stspg.io/j45j2k0cwnnz"]}],"documents":[{"id":102603,"url":"https://lightning.ai/security-incident","title":"October 2026 Security Incident | Lightning AI","kind":"vendor","source":"analyst","publisher":null,"text":"Vendor incident page (read 2026-11-08).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":102604,"url":"https://stspg.io/j45j2k0cwnnz","title":"Lightning AI Status - Service is down to address a security incident","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[{"company":"Lightning AI","domain":"stspg.io","url":"https://stspg.io/j45j2k0cwnnz","kind":"statuspage","published_at":"2026-10-16T03:08:57+00:00","quote":"Read-only access to Drive is restored.","confidence":0.8999999761581421,"source":"statuspage","created_at":"2026-11-08T17:12:36+00:00","entry":"unknown"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}