Latest update
October 23, 2026. We are currently investigating the potential exposure of keys for Unbounce's integration with third party applications with the help of third-party security experts. As a precaution, we've revoked or replaced certain integration connections and are asking all customers to reset their password and set up two-factor authentication again. If you haven't already, please complete the steps below at your earliest convenience.
What happened
We detected a security event that began on or about October 14, 2026 that may have resulted in the exposure of keys for Unbounce's integration with third party applications.
We are investigating this issue with the assistance of third-party security experts, and our investigation has found no evidence that any credentials have been misused. However, we strongly recommend that you take the steps below at your earliest convenience.
What you need to do
1. Reset your password and two-factor authentication
The next time you log in, you'll be asked to reset your password. Follow the instructions on screen. If you use two-factor authentication, you'll set it up again at the same time. It only takes a couple of minutes.
If you've used the same password on any other site, we recommend changing it there too.
2. Reconnect your integrations
Form-submission email notifications, webhooks and Zapier form integrations (outbound) were not revoked or replaced, and need no action.
For everything else, find each integration you use below. Your field and list mappings are kept in every case.
| Integration | What's happening | What to do |
|---|---|---|
| Salesforce | Will not work until you reconnect | In Unbounce, go to Integrations and click Re-authenticate on your Salesforce connection. Then approve Unbounce in Salesforce. Optional: you can also revoke the previous Unbounce connected app in Salesforce under Setup > Connected Apps OAuth Usage. |
| AWeber | Will not work until you reconnect. Leads captured in the meantime are saved in Unbounce and can be re-sent. | In Unbounce, go to Integrations and click Re-authenticate. Then approve Unbounce in AWeber. |
| Zapier | Connection ended on October 22 | In Zapier, open My Apps (or App Connections), find Unbounce and click Reconnect. |
| WordPress | Your pages stay live, but you can't edit, add or delete them until you reconnect | In WordPress admin, open the Unbounce plugin page and click Authorize With Unbounce. |
| Mailchimp | Still working | In Mailchimp, go to Integrations > Manage > Other connections and disconnect Unbounce. Regenerate any API key you created for Unbounce. Then re-authenticate Mailchimp in Unbounce Integrations. |
| HubSpot | Still working. We replaced the integration keys on October 20. | Nothing to reconnect. |
| Marketo, Keap, Insightly, Campaign Monitor | Still working | Create new API credentials in that app. Then in Unbounce Integrations, choose Update credentials on that connection. |
| Other apps connected to Unbounce | Connection ended on October 22 | Reconnect your Unbounce account inside each app. |
| Unbounce API keys | Still working | Regenerate any Unbounce API keys connected to your account. |
3. Review recent activity
Check the activity in your Unbounce account and in each connected app since October 14. If anything looks unfamiliar, contact Support.
For reference, legitimate traffic from our webhooks and integrations typically comes from these IP addresses: 50.19.99.184, 63.186.16.150, 18.196.144.222 and 18.195.113.15.
Frequently asked questions
Why do I have to reset my password?
For security reasons, we're requiring all customers to reset their password and re-set two-factor authentication.
Do I really have to set up two-factor authentication again?
Yes. Setting it up again makes sure only you hold a valid code for your account. It only takes a couple of minutes.
Was my data accessed?
While our investigation is still ongoing, we have not found any evidence that integration keys have been misused or that data was accessed. We will provide relevant updates when we have additional information to share with customers.
Will I lose my integration settings when I reconnect?
No. Your field and list mappings are kept.
Will I lose leads while AWeber is disconnected?
No. Leads captured in the meantime are saved in Unbounce and can be re-sent once you reconnect.
Are my WordPress pages still live?
Yes. Your pages keep working. You just can't edit, add or delete them until you reconnect.
For partner app developers
Client secrets and tokens for partner apps were revoked, so your app has stopped working with Unbounce.
- Contact Support to get a new client secret.
- Make sure your app handles 401 responses by asking users to reconnect their Unbounce account.
- Let your users know they'll need to reconnect Unbounce in your app.
- Check your logs for Unbounce API activity since October 14 that you don't recognize, and report it to Support.
Need help?
We understand this is frustrating, and we sincerely regret any disruption to your work. If you have questions or need help reconnecting, please contact Support.