Is Sendblue Safe? What Its August 2026 Incident Report Says
TL;DR
On August 5, 2026, Sendblue disclosed unauthorized access to conversation records, including message content and phone numbers, through a database security-rules vulnerability, plus a phishing campaign targeting numbers tied to its customers' messaging. Sendblue fixed the flaw the day it was reported and disclosed publicly within days, which deserves credit. The durable lesson is the question set: ask any messaging vendor, us included, where message content lives, who can read it, and what happens when something goes wrong.
On this page
What happened at Sendblue?
Per Sendblue's August 5, 2026 incident report: On August 1 contacts received fraudulent SMS impersonating Sendblue customers asking for $49 deposits. These were sent from external Sinch numbers, not Sendblue's platform.
July 31: Firebase/Firestore vulnerability reported. Fixed same day. But unauthorized access to records found on July 7 and July 10, weeks earlier.
All facts in this post come from that disclosure. The report itself is the source of record at sendblue.com/blog/sendblue-security-incident-update.
Sendblue incident timeline
- 1First unauthorized access detectedJuly 7
- 2Second unauthorized access detectedJuly 10
- 3Vulnerability reported and fixedJuly 31
- 4Phishing campaign sent to contactsAugust 1
- 5Incident disclosed publiclyAugust 5
What data was involved?
Per disclosure: message content, phone numbers, contacts, Sendblue lines, usernames, metadata. Some access confirmed; others had reachable records. Direct notification underway.
Conversation records: reps' words, prospect answers, connecting numbers. The phishing campaign shows why: attackers impersonated the businesses contacts were texting with.
What did Sendblue get right?
Sendblue fixed same day. Published report: scam domain, sending numbers, sample message, exact dates. Engaged Oneleet, reported authorities, got Sinch and domain to act.
Fast, specific disclosure is what buyers want from any vendor. A vendor that discloses quickly shows what it'll do when something breaks.
What should you ask any messaging vendor about security?
The useful output of an incident like this is a better question set, applied to every vendor you evaluate, including us. A vendor's practices matter more than a moment-in-time audit.
Before you put customer conversations on any platform, get answers to these in writing:
- Where is message content stored, and who inside the company can read it?
- Are customer workspaces isolated from each other, and how has that isolation been tested?
- How would you detect unauthorized access to conversation data, and how long would detection take?
- What is your commitment on breach notification: how fast, how public, how specific?
- Has the company had a security incident before, and how did it handle disclosure?
- Is there a working channel for security researchers to report vulnerabilities?
- Can I delete my data, completely, when I leave?
How Blue Reacher approaches security
Blue Reacher publishes security practices at /security: TLS encryption, rotatable API keys, customer isolation, immediate opt-out, and on-request deletion.
Compliance details are at /trust. For specific questions, book a 15-minute Blue Funnel Map call and get direct answers in writing.
Frequently asked questions
Is Sendblue safe to use after the August 2026 incident?
Read the full incident report. Sendblue fixed same day, disclosed publicly, engaged third-party review. Counterweight: records (messages, numbers) were accessed before detection. Ask Sendblue the questions here.
What data was accessed in the Sendblue incident?
Per disclosure: message content, phone numbers, contacts, Sendblue line associations, org usernames, metadata accessed. Unauthorized access found July 7 and July 10, 2026. Some access confirmed; Sendblue notifying directly.
Did the incident involve iMessage itself?
iMessage NOT affected. Vulnerability: Firebase/Firestore security rules on Sendblue's cloud DB. Phishing SMS from external Sinch toll-free numbers. This category of risk exists with any platform storing conversations.
What is the phishing campaign Sendblue described?
Fraudulent SMS impersonated Sendblue from two toll-free numbers, asking $49 'onboarding deposit' via scam domain. Sinch killed the numbers; domain down. Warn contacts: don't click, don't pay.
What's Blue Reacher's security posture?
Full compliance posture: [/trust](/trust) with control mapping and documents. Practices: TLS in transit, rotatable API keys, least-privilege access, workspace isolation, opt-out enforcement, data deletion on request, disclosure channel. [Demo call](/book) for direct answers.
Keep reading
More on choosing a platform
Linq Is Closing Sales Accounts on 19 October: What to Do Now
Linq has told customers who use it for sales, prospecting and outreach that it is closing their accounts, with lines removed from Monday 19 October 2026. Here is what the notice says, why Linq is doing it, and what to do with your number before the deadline.
The Five Pages That Tell You If a Vendor's Numbers Hold Up
Most buyers read one page before a demo, and it is the pricing page. Five pages exist on nearly every messaging vendor's site, they get updated on different days, and when two of them disagree the disagreement is the most useful thing you will find all week. Here is the read order, with live contradictions dated 16 September 2026.
Per-Message Texting Bills You in Credits, Not Messages
Every per-message texting quote you have been given prices a unit called a credit. A credit is a 160-character segment, an emoji cuts it to 70, and picture messages cost three. The definition almost never appears on the pricing table. Read from vendor and carrier pricing pages on 10 September 2026.
Put this on your pipeline
Blue Reacher runs outbound iMessage for B2B sales teams, from your CRM, with setup handled for you.
Book a demo