---
id: "INC-lightning-h20stxqvwg8r"
page: "https://infrastack.ai/live/INC-lightning-h20stxqvwg8r"
kind: "incident"
aliases: []
title: "Lightning AI: customer credentials compromised, Studio platform taken offline since Oct 16"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Lightning AI", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["credential-compromise", "hosted-service", "incident", "lightning", "lightning-ai", "security", "vendor"]
not_affected_if: ["gpu-cluster-rental-only", "managed-kubernetes", "no-lightning-ai-account", "slurm"]
published_at: "2026-10-16T03:08:57+00:00"
first_seen_at: "2026-11-08T16:58:25+00:00"
updated_at: "2026-11-08T16:59:42+00:00"
sources: [{"source": "statuspage", "url": "https://stspg.io/j45j2k0cwnnz", "first_seen_at": "2026-11-08T16:58:25+00:00"}, {"source": "analyst", "url": "https://lightning.ai/security-incident", "first_seen_at": "2026-11-08T16:59:42+00:00", "cites": ["https://lightning.ai/security-incident", "https://stspg.io/j45j2k0cwnnz"]}]
exploit_sources: []
---

# Lightning AI: customer credentials compromised, Studio platform taken offline since Oct 16

Link for people: https://infrastack.ai/live/INC-lightning-h20stxqvwg8r (this .md is for agents)

Lightning AI identified unauthorized access to credentials on Oct 15 (23:00 UTC) and revoked all user access on Oct 16 01:00 UTC. The vendor believes certain customer credentials were compromised and used to reach environments and connected third-party services. Affected: Lightning Studio platform services (Studio, Deployments, Pipelines, Drive). Not affected per vendor: GPU cluster rental infrastructure, managed Kubernetes and SLURM. Read-only Drive access was restored Oct 28 via CLI (Lightning SDK required); Studio, Jobs and Deployments are not yet restored. An external firm is investigating.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Lightning AI affected range not listed fixed no fixed version listed

## How to check

You use Lightning Studio, Deployments, Pipelines or Drive: check whether Lightning AI emailed you account-specific information (the vendor says no notice means not identified as affected so far). Review access logs of GitHub, cloud accounts and any third-party services whose credentials were stored in your Studio environments or VMs, for activity since Oct 15.

## Fix

No patch. Vendor recommends all users: rotate secrets, API keys and credentials stored in AI Studios (e.g. GitHub credentials); update credentials for third-party services accessed by your VMs; review third-party systems and access logs. Vendor has already revoked identified keys tied to your cloud accounts used on the platform.

## Timeline

- 2026-10-16T03:08:57+00:00 confirmed by Lightning AI (statuspage) https://stspg.io/j45j2k0cwnnz "Read-only access to Drive is restored."
- 2026-11-08T16:58:25+00:00 statuspage https://stspg.io/j45j2k0cwnnz
- 2026-11-08T16:59:42+00:00 analyst https://lightning.ai/security-incident — Read vendor incident page and status page. Scope of data accessed not stated; exploitation details unknown; no mitigations. Rotation advice from vendor's own words.

## Documents

- [advisory] October 2026 Security Incident | Lightning AI https://lightning.ai/security-incident
- [describes] Lightning AI Status - Service is down to address a security incident https://stspg.io/j45j2k0cwnnz

## From the sources

Read-only access to Drive is restored. More details here: https://lightning.ai/security-incident

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_