On Wednesday 21 October 2026, a global issue originating from one of our third-party suppliers (PHP) affected thousands of online services worldwide. As a precaution, we took MyLogin offline at 12.58pm BST (10.58pm AEDT) while we monitored the situation.
All services are now back online and running as normal. We chose a careful approach rather than the fastest one, bringing services back in stages and checking each part before moving on to the next. The final service was restored at 10.45am BST (8.45pm AEDT) on Thursday 22 October 2026.
What we did
We take any vulnerability at a third-party supplier very seriously, and protecting our systems and the data within them is our top priority. We applied the supplier’s security update before bringing any service back online, so no service was available without the update at any point. Alongside this, our security team carried out its own rigorous checks and monitoring across our systems. These found no evidence that our systems or any school or customer data were affected. We’ll continue to monitor our systems closely as part of our usual security practice.
What you need to do
There’s nothing you need to do. Staff and pupils can sign in to MyLogin again, including Google Workspace, Microsoft and any third-party apps they access through it. Admins can log in and make changes as normal.
Staying safe
As this issue has been widely reported across global news outlets, you may receive emails that claim to be about it. We’ll never ask for your password or login details by email. If an email looks suspicious, please don’t click any links and contact us first.
FAQs
What happened?
On Wednesday 21 October 2026, a global issue originating from one of our third-party suppliers (PHP) affected thousands of online services worldwide. As a precaution, we took [Brand] offline while we monitored the situation. All services are now back online and running as normal.
Was my data affected?
We applied the supplier’s security update and carried out our own rigorous checks across our systems. These found no evidence that our systems or data held within our system were affected.
Why did you go offline if nothing was affected?
We take any vulnerability at a third-party supplier very seriously. Taking our services offline meant we could apply the security update and carry out our own checks before anyone used them again. We gave serious consideration to all options and the operational impact of those options to end users. Our systems are widely used, and to mitigate any risk to users, we acted quickly as the vulnerability of the third-party supplier news spread across the world.
How long were services unavailable?
From 12.58pm BST on Wednesday 21 October 2026. We restored services in stages from 21:30 pm BST that evening, and all services were fully restored by 2.00pm BST on Thursday 22 October 2026.
Do I need to do anything?
No, there’s nothing you need to do.
I’ve received an email about this issue. Is it from you?
We’ll never ask for your password or login details by email. If an email looks suspicious, please don’t click any links. Forward it to support@mylogin.com and we’ll check it for you.
Our privacy or information security team would like more detail. Who should we contact?
Please email support@mylogin.com and we’ll arrange for the right person to get in touch.
If you have further questions, or your privacy or information security team would like more detail, please contact support@mylogin.com.
