# 1Password: Major incident: Service Degradation Affecting Sign In, SSO, MFA

**Summary:** 1Password reported major degradation affecting sign in, SSO, MFA and access to items, including USA/Global services, starting 2025-11-18 17:22 UTC and resolved at 2025-11-18 19:15 UTC (1 h 52 min). A mitigation restored service at 2025-11-18 18:22 UTC, followed by monitoring until resolution. _(machine-written, sol)_
- Kind: Major incident · Label: degradation (model (Jev))
- Changed: 2025-11-18 17:22 UTC · Detected: 2026-10-17 18:22 UTC
- [Source: https://stspg.io/298y7wsr39w5](https://stspg.io/298y7wsr39w5)
- [Company: 1Password](https://rewindex.com/company/1password.md)
- Versions: before (none: first archived) → after incident\_version:302/hxqx48n0hpg6@2a5fe0779937
- Change 1 of 1 for this incident

## What changed

**1. Added: Title**

```diff
+ Service Degradation Affecting Sign In, SSO, MFA
```

**2. Added: Impact**

```diff
+ major
```

**3. Added: Status**

```diff
+ postmortem
```

**4. Added: Start time**

```diff
+ 2025-11-18 17:22 UTC
```

**5. Added: Resolved time**

```diff
+ 2025-11-18 19:15 UTC
```

**6. Added: Affected components**

```diff
+ 1Password Connect, Access to passwords and other items, Admin console, Billing, Command Line Interface (CLI), Multi-factor Authentication (MFA), Saving password and other items, Service Accounts, Sign in, Sign up, SSO (Single Sign On), Syncing items between your devices, USA/Global - 1Password Connect, USA/Global - Access to passwords and other items, USA/Global - Admin console, USA/Global - Billing, USA/Global - Command Line Interface (CLI), USA/Global - Multi-factor Authentication (MFA), USA/Global - Saving password and other items, USA/Global - Service Accounts, USA/Global - Sign in, USA/Global - Sign up, USA/Global - SSO (Single Sign On), USA/Global - Syncing items between your devices
```

**7. Added: Update** (investigating) · 2025-11-18 17:22 UTC

```diff
+ We are actively investigating an issue causing significant service degradation across 1Password impacting sign in, SSO, MFA, and accessing items.
```

**8. Added: Update** (investigating) · 2025-11-18 17:27 UTC

```diff
+ We are continuing to investigate this issue.
```

**9. Added: Update** (investigating) · 2025-11-18 17:51 UTC

```diff
+ We are continuing to investigate this issue.
```

**10. Added: Update** (investigating) · 2025-11-18 17:59 UTC

```diff
+ We are continuing to investigate this issue.
```

**11. Added: Update** (identified) · 2025-11-18 18:04 UTC

```diff
+ We identified the issue, the engineering team is working on a mitigation and we're starting to see recovery.
```

**12. Added: Update** (monitoring) · 2025-11-18 18:22 UTC

```diff
+ We implemented a mitigation and service is restored. We will continue to closely monitor performance to ensure the issue is fully resolved.
```

**13. Added: Update** (resolved) · 2025-11-18 19:15 UTC

```diff
+ This incident has been resolved.
```

**14. Added: Update** (postmortem) · 2025-11-21 19:05 UTC

```diff
+ # Incident Postmortem - Cloud Services Degraded **Date of Incident:** 2025-11-18  **Time of Incident \(UTC\):** 5:03pm UTC - 6:05pm UTC  **Service\(s\) Affected:** SSO, sign in, sign up, CLI, web interface, access to vault content and other items, admin console, MFA **Impact Duration:** ~60 mins ## Summary On November 18, 2025, at 5:03 PM UTC, 1Password experienced degraded and temporarily unavailable cloud services for customers in the US region. The issue was caused by database resource exhaustion, causing operations to fail and connections to be rejected. This was not a security incident and no customer data was impacted. The issue was resolved by resizing the database to restore normal performance and ensure additional capacity for future growth. ## Impact on Customers * **Single Sign-on \(SSO\), Multi-factor Authentication \(MFA\):** Users with SSO or MFA enabled experienced delays, and in some cases failures to log in. * **Browser Extension:** Users who needed to authenticate via the web interface were unable to unlock their vaults. * **Web Interface, Administration**: Customers were unable to log in, sign-ups failed, syncing between devices was not functioning, access to vault and other items were unavailable and the admin console was not reachable. * **API Access:** CLI users and API requests received timeout errors and slow responses. * **Number of Affected Customers \(approximate\):** All customers utilizing cloud interfaces and APIs in the affected region for the duration of the incident. * **Geographic Regions Affected \(if applicable\):** US/Global. ## What Happened? * **Timeline of Events \(UTC\):**     * 2025-11-18 4:59pm: Automated monitoring detects increased errors     * 2025-11-18 5:03pm: Team began investigating     * 2025-11-18 5:09pm: Servers restarted, service is still degraded     * 2025-11-18 5:23pm: Public status page updated to Investigating and services Degraded     * 2025-11-18 5:25pm: Servers scaled down to reduce database load     * 2025-11-18 5:41pm: Database instance size upgrade started     * 2025-11-18 5:44pm: Potentially problematic cron job disabled     * 2025-11-18 5:56pm: Services slowly started to scale up     * 2025-11-18 5:57pm: Services started to come back as the database instance resize completes     * 2025-11-18 6:05pm: Incident marked as Identified     * 2025-11-18 6:05pm: Team continues to monitor, performance has returned to normal levels     * 2025-11-18 6:23pm: Incident marked as Monitoring and services Operational     * 2025-11-18 7:16pm: Incident marked as resolved      * **Root Cause Analysis:** The refactor of a feature increased the impact of a poorly performing query that had previously gone undetected. The result was the exponential increase in resource consumption for the main database. Once resources were fully exhausted, the service rejected connections and all requests failed. * **Contributing Factors \(if any\):**     * Non-performant queries     * Database under-provisioned      ## How Was It Resolved? * **Mitigation Steps:**     * Background services were halted to reduce load on the database.     * Application servers were scaled down to further reduce load.      * **Resolution Steps:** Increasing the database instance size resolved the issue. * **Verification of Resolution:** Monitoring metrics were closely observed to ensure error rates returned to normal and database performance had stabilized. ## What We Are Doing to Prevent Future Incidents * **Improving monitoring:** We are updating our monitoring systems to better detect database issues like this before impacting customers. * **Improve database performance:** We are refactoring the responsible query to improve performance and reduce load, and tuning the background service to prevent resource contention. ## Next Steps and Communication No action is required from our customers at this time. We are committed to providing a reliable and stable service, and we are taking the necessary steps to learn from this event and prevent it from happening again. Thank you for your understanding. Sincerely, The 1Password Team
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2025-11-18 17:22 UTC | Major incident: Service Degradation Affecting Sign In, SSO, MFA (this change) | degradation |

All 1Password changes: [timeline](https://rewindex.com/company/1password/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/i14f87c6fa59bb7 · Markdown: https://rewindex.com/change/i14f87c6fa59bb7.md · JSON: https://rewindex.com/api/v1/changes/i14f87c6fa59bb7 · Generated 2026-10-18T02:28:14.997Z