Lightning AI's security incident notice says that on 15 October at 11:00 PM UTC it identified a security incident on the Lightning Platform involving unauthorized access to credentials, and that it revoked all user access to the platform on 16 October at 1:00 AM UTC.

Lightning says the incident involves Lightning Studio Platform services such as Studio, Deployments, Pipelines and Drive, and not the GPU cluster rental infrastructure or managed services like Kubernetes and SLURM.

Lightning says it believes certain customer credentials were compromised to gain access to environments and connected third-party services, that it has revoked all identified credentials used in the incident, and that it is working with an independent external cybersecurity firm.

Lightning says customers identified as potentially affected to date have been notified, and that users who have not received a notification have not been identified as affected based on its investigation to date.

The notice itself carries no date; Lightning's status page first reported emergency maintenance at 03:08 UTC on 16 October, linked the notice at 20:34 UTC that day, last updated the incident at 12:49 UTC on 19 October, and still listed it as unresolved ('Service is down to address a security incident') when checked on 26 October (Perth).