What happened
Company says the service was not hacked
On February 12, 2026, Octo Browser described an incident on its blog: attackers logged into several users’ accounts and accessed their profiles. According to the company, the logins succeeded on the first attempt, the affected users had not enabled two-factor authentication, and their data had appeared in leaks from industry websites. The company rules out a leak of passwords from its own database, as well as password guessing. It considers logins with passwords from third-party leaks unlikely, because one of the affected users had changed their password after the leak. The company identifies stealers on users’ devices as the most likely cause. It did not specify when the incident occurred, and its version has not been independently confirmed.
Who was affected
several accounts
Several users, according to the company. The exact number was not disclosed.
Losses
not reported
What the company did
It disclosed the incident itself on its blog and in its channels and urged users to enable 2FA and to set passwords on important profiles. On March 30, 2026, without directly linking the release to this incident, it released version 2.10.9 with additional checks for suspicious logins, email alerts for logins from new devices, and 2FA and email confirmation for critical actions.
Our editors collected and checked the sources; the text says who gives each figure.