Fin is back to normal. Between 14:45 - 15:30 UTC, Fin was slower than usual in the US hosting region.

This issue should now be resolved and all services are restored to normal functionality.

Please don’t hesitate to reach out to team@intercom.io if you have any further questions or if you’re still seeing any unexpected behaviour

Meta services are back up and running, and we’ve caught up on queued messages.

Open browser tabs with old logins to the Intercom app may be causing ongoing login/logout churn - closing old tabs or restarting web browser will prevent this from happening.

Resolved

We're closing this incident. On April 30, 2026 an attacker published malicious versions of intercom-client (v7.0.4) and intercom-php (v5.0.2). Both were removed from distribution within hours of discovery. No evidence of unauthorized access to customer data or Intercom accounts was found.

If you installed intercom-client@7.0.4 or intercom-php@5.0.2 on April 30 and haven't already done so, we recommend rotating any credentials configured in that environment. All other versions of both packages are safe.

We kept the incident open out of an abundance of caution while we completed credential rotation, hardened our infrastructure, and monitored closely for any follow-on activity. We're now satisfied it's fully remediated.

On June 1, 2026, between approximately 11:08 UTC and 13:24 UTC, a small subset of customers experienced degraded performance across Fin and Inbox. During this period, affected customers may have experienced inbox loading issues, delays in conversation updates, message delivery failures, conversation assignment issues, and disruptions to Fin replies.

This issue is now resolved and all services are restored to normal functionality.

Please don’t hesitate to reach out to team@intercom.io if you have any further questions or if you’re still seeing any unexpected behaviour

The issue is resolved, reporting data is up to date.

The issue is resolved.