This issue should now be resolved and all services are restored to normal functionality.

Please don’t hesitate to reach out to team@intercom.io if you have any further questions or if you’re still seeing any unexpected behaviour

Meta services are back up and running, and we’ve caught up on queued messages.

For EU customers between 09:34 - 10:18UTC, and AU customers between 09:36 - 10:06UTC Mobile SDK endpoints and mobile push were impaired. This issue should now be resolved and all services are restored to normal functionality.

Please don’t hesitate to reach out to team@intercom.io if you have any further questions or if you’re still seeing any unexpected behaviour

Open browser tabs with old logins to the Intercom app may be causing ongoing login/logout churn - closing old tabs or restarting web browser will prevent this from happening.

Resolved

We're closing this incident. On April 30, 2026 an attacker published malicious versions of intercom-client (v7.0.4) and intercom-php (v5.0.2). Both were removed from distribution within hours of discovery. No evidence of unauthorized access to customer data or Intercom accounts was found.

If you installed intercom-client@7.0.4 or intercom-php@5.0.2 on April 30 and haven't already done so, we recommend rotating any credentials configured in that environment. All other versions of both packages are safe.

We kept the incident open out of an abundance of caution while we completed credential rotation, hardened our infrastructure, and monitored closely for any follow-on activity. We're now satisfied it's fully remediated.

The issue is resolved.