In a notification updated on November 6, 2026, Plerdy confirms that its tracking script was altered between August 27 and September 3. The incident forms part of the Poisoned Source campaign investigated by Sekoia. For a small business, the practical questions concern both its analytics account and phones visiting websites that load third-party scripts.
A tracking component became an entry point
Plerdy attributes access to its servers to stolen administrator credentials. Customer contact data, including names and email addresses, was also accessed. Its tracker then loaded external code. The provider says it removed that code on September 3, replaced server credentials and reset account passwords the next day. Those measures concern its infrastructure and accounts; they do not establish the condition of each visitor’s device.
Keep Plerdy separate from the wider campaign
Sekoia also describes directly compromised websites and impersonating domains. Its attribution to APT29 is an assessment made with moderate-to-high confidence. The Hacker News highlights uncertainty about how visitors were selected. Capabilities seen elsewhere in Poisoned Source should not be described as confirmed theft from every visitor to a Plerdy-enabled website.
Check the team’s phones
The described attacks use previously patched iOS or Android flaws. Check operating-system and browser updates on phones used for business email and other services. A device that no longer receives fixes needs a replacement decision. Preserve evidence from an actual alert before resetting a phone and losing traces that could help an investigation.
Recover accounts and sessions separately
Plerdy says it ended its users’ login sessions during the reset. For other services used on a suspect phone, examine sign-in history and use each service’s own sign-out controls. Bulwark Black develops this distinction between repairing the phone and recovering sessions. If a Plerdy password was reused, replace it on the other services too.
The link with Soclyde
A Plerdy password distinct from the email password limits the consequences of secret reuse. Soclyde keeps unique passwords in an encrypted vault on your devices. This helps organise credential replacement across a team. It does not neutralise a third-party script or protect a session already open on a compromised phone.
Takeaway
Separate three checks: the Plerdy account, mobile security updates and sessions on other services. Suspected exposure is not proof of theft. When an anomaly is documented, the hacked password response guide helps organise account recovery.
