Security Incident — October 2026
Last updated: October 26, 2026 at 1:57 PM ET
Current status: Recovery — services restored; investigation ongoing
Service status
Further updates will be published here as material information becomes available.
What happened
A security incident has affected the hosting environment used by several Gooverio Labs products. The provider stores deployment configuration for our products, including credentials used to connect our applications to payment processing and third-party services. Some of those credentials were exposed. The full scope and cause of the incident have not yet been established, and references to our hosting environment should not be read as confirmation that our hosting provider’s wider platform was breached.
An attacker used one exposed credential to run unauthorized usage against a third-party AI service. That credential has been revoked and the integration disabled. We have not identified any other misuse of the exposed credentials at this time, and we are continuing to investigate.
What we have done
- Rotated all payment-processing credentials and webhook secrets for affected products
- Revoked and disabled the misused third-party API credential
- Began migrating all services off the affected provider to new infrastructure with isolated secret management
- Started a review of exactly which credentials were exposed and what each one could access
Customer data
Full payment card numbers are never stored on our systems; they are held by our payment processor and were not exposed in this incident.
We are still determining whether any personal information — such as names, email addresses, or account details — could have been accessed through the exposed credentials. If we confirm that your data was affected, we will contact you directly at the email address on your account.
We have not yet determined whether customer information was accessed, copied or altered without authorization. For VoiceSeal, the investigation includes stored voice embeddings derived from enrollment recordings, consent and authorization records, and associated account information.
What you can do
- Be cautious of emails claiming to be from Gooverio Labs or any of our products. We will never ask for your password or payment details by email.
- If you used your account password on other sites, change it there.
- If you notice unfamiliar activity on your account or payment method, contact us at security@gooverio.com.
Contact
Updates
- October 26, 2026 at 1:57 PM ET
Security incident — recovery report
October 26, 2026
Current status: Services restored; investigation into potential data access remains open.
Service recovery
Since our previous update:
- VoiceSeal has been rebuilt and restored on replacement infrastructure.
- Groovie has completed migration and recovery work.
- FanMind is back online following its database migration and credential rotation.
- Candidfy has been restored.
Other affected beta projects have no reported end-user or financial data.
Confirmed findings
We confirmed unauthorized use of one third-party AI-service credential. That credential has been disabled.
An exposed object-storage credential that remained active during the response was deleted, and its revocation was independently confirmed.
Checks of VoiceSeal’s restored database identified no evidence of unauthorized account creation, privilege changes or other modifications within the scope reviewed. Available content-signing records showed no unauthorized signing activity.
These findings do not establish whether customer information was read or copied.
Customer information
For VoiceSeal, potentially affected information includes names, email addresses, password hashes and account records; associated consent and voice-licensing records; and stored voice embeddings for enrolled users.
Voice embeddings are numerical representations of voice characteristics derived from enrollment recordings. Account passwords were stored as salted bcrypt hashes rather than plain text. Full payment card numbers are not stored on VoiceSeal’s systems.
Historical access logging was not enabled on the relevant data stores during the exposure period. We therefore cannot confirm or rule out unauthorized access to this information.
Direct notices are being sent to all 47 potentially affected VoiceSeal users, using separate notices for the 25 enrolled-voice users and 22 account-only users.
Assessment of potential impact and applicable notification requirements across the other affected products continues.
Actions completed and continuing work
We have isolated the affected environment, rotated high-value service credentials, revoked identified exposed credentials, restored services and strengthened access controls.
Additional logging has been enabled for VoiceSeal’s sensitive data stores. This improves visibility going forward but cannot reconstruct historical access.
Further work on centralized secrets management and more tightly separated access across products continues. We are reviewing available evidence and assessing applicable individual and regulatory notification requirements.
Recommended precautions
VoiceSeal users should change their password by visiting voiceseal.io directly and use a unique password. If that password was reused elsewhere, change it on those services too.
Be cautious of unexpected messages referring to our products, your account or voice enrollment. We will never ask you to send passwords, full payment card details or voice recordings by email.
Further updates
Service restoration does not close the investigation. We will publish further material findings and contact affected individuals as appropriate.
VoiceSeal notice: https://voiceseal.io/security-notice.html
Questions or reports of suspicious activity: security@gooverio.com
We are sorry for the disruption and uncertainty this incident has caused.
— Gooverio Labs / VoiceSeal Inc.
- October 25, 2026 at 9:20 PM ET
Gooverio Labs — Security Incident Update
Since our previous update, we have completed additional credential rotation and migration work. Recovery and investigation continue.
Confirmed unauthorized activity
We have confirmed unauthorized use of one exposed third-party AI-service credential. That credential has been disabled.
We also deleted an exposed object-storage credential that remained active during our review and independently confirmed its revocation.
Our team reports that high-value credentials for the affected services have now been rotated. We are continuing to verify revocation of old credentials and review account access.
VoiceSeal customer information
We have not established whether VoiceSeal’s stored voice embeddings, consent and authorization records, or associated account information were accessed, copied or altered without authorization.
Historical access logging was not enabled on the relevant storage systems. This limits what we can determine about past access. Confirmed abuse of one credential does not establish that other credentials were used, but it reinforces the need to assess the wider exposure carefully.
Our review of available content-signing records has not identified unauthorized signing activity. This finding does not resolve the separate question of access to customer information.
Recovery and further work
We are continuing service restoration, reviewing available records, auditing restored data and strengthening credential management and logging.
We are assessing notification requirements across the affected products and will notify affected individuals and relevant authorities as required by applicable law.
Service restoration does not mean the investigation is complete.
We are sorry for the disruption and uncertainty. Current service information and further updates are available at:
https://www.gooveriolabs.com/status
Questions or reports of suspicious activity: security@gooverio.com
- October 24, 2026 at 1:54 PM ET
FanMind service update — October 24, 2026
FanMind is back online following the outage from Thursday evening, October 22, to Saturday afternoon, October 24 (UTC).
Since our last update, we have completed the database migration, rotated the application’s credentials and checked its core functions. Fixture results from the outage window have been ingested and scored.
During the outage, pages failed to load, tactical plans could not be submitted, and some match reminders were not sent. We’re sorry for the disruption.
Groovie is now fully migrated, and we have added further security measures to reduce the risk of a similar incident in the future.
- October 24, 2026 at 1:30 AM ET
Gooverio Labs — Security Incident Update
October 24, 2026
We are continuing recovery and investigation following a security incident affecting the hosting environment used by several Gooverio Labs products.
VoiceSeal
The affected backend remains offline and isolated while we rebuild on replacement infrastructure.
Our team has rotated high-value credentials covering authentication, databases, object storage, payment processing, identity-provider integrations and content signing. An exposed object-storage key that remained active was deleted, and its revocation was independently confirmed.
Our review of available content-signing records has not identified unauthorized signing activity. That finding relates specifically to the signing activity reviewed; it does not establish whether customer information was accessed.
Customer information
We cannot currently confirm or rule out unauthorized access to VoiceSeal’s stored voice embeddings, consent and authorization records, or associated account information.
Access logging was not enabled on the relevant data stores during the exposure period. This limits our ability to establish whether information was read or copied. We are treating these records as potentially accessed while reviewing other available evidence.
FanMind
FanMind’s migration is nearing completion, and its configuration credentials have been rotated. FanMind does not store financial details. Assessment of any potential impact on other customer information remains ongoing.
Further work
We are completing service restoration, auditing restored data, reviewing available records and strengthening access logging and credential management. Logging has been enabled on the relevant stores going forward; it does not reconstruct historical access.
We are assessing applicable notification requirements and will notify affected individuals and relevant authorities as required by law. Service restoration and the investigation into potential data access are separate workstreams.
We are sorry for the disruption and uncertainty this incident has caused.
Please remain alert to unexpected messages claiming to represent our products. We will never ask you to send passwords or full payment card details by email.
Updates: https://www.gooveriolabs.com/status
Questions or suspicious-activity reports: security@gooverio.com
- October 23, 2026 at 3:55 PM ET
Security incident update
Gooverio Labs is continuing to investigate a security incident affecting the hosting environment used by several of our products, including VoiceSeal.
What we know
Credentials used to connect our applications to databases, storage and third-party services were stored in the affected environment. Those credentials are being treated as potentially compromised.
For VoiceSeal, the affected hosting environment has been isolated, and the database password has been rotated. Work to secure other credentials and restore services on replacement infrastructure is continuing.
What remains under investigation
We have not yet determined whether customer information was accessed, copied or altered without authorization.
For VoiceSeal, the investigation includes stored voice embeddings derived from enrollment recordings, consent and authorization records, and associated account information. Available records do not currently allow us to confirm or exclude unauthorized access to that information.
Our response
We are reviewing available records, assessing the scope of potential access, and continuing credential remediation and service-restoration work. We are also assessing notification obligations and will notify affected individuals and relevant authorities as required by applicable law.
Restoration of a service does not mean the investigation into potential data access is complete.
What customers can do
Be cautious of unexpected emails or messages claiming to represent Gooverio Labs or our products. We will never ask you to send your password or full payment card details by email.
Please report suspicious messages or unfamiliar account activity to security@gooverio.com.
We are sorry for the disruption and uncertainty. Further updates will be published as material information becomes available at:
https://www.gooveriolabs.com/status
— Gooverio Labs
- October 23, 2026 at 10:30 AM ET
Migration continuing. Groovie's payment and business services remain stable on new infrastructure; remaining Groovie components are being brought up this morning. Voiceseal migration is now in progress and is our current priority. Our review of what the exposed credentials could access is ongoing, including a review of access records from our prior hosting provider and storage services; we will report findings here as soon as they are confirmed. No new findings on customer data at this time.
- October 23, 2026 at 2:10 AM ET
We are continuing to investigate a security incident affecting the hosting environment used by several Gooverio Labs products. Service restoration and investigation are ongoing. We are clarifying our earlier notice: the investigation has not yet established the full scope or cause of the incident, and references to our hosting environment should not be read as confirmation that our hosting provider’s wider platform was breached. We have not yet determined whether customer information was accessed, copied or altered without authorization. For VoiceSeal, the investigation includes stored voice embeddings derived from enrollment recordings, consent and authorization records, and associated account information. We are reviewing available evidence, securing affected credentials and restoring services on replacement infrastructure. We will notify affected individuals and relevant authorities as required by applicable law. Further updates will be published here as material information becomes available.
- October 22, 2026 at 10:07 PM ET
Database migration complete. All product databases have been moved to new infrastructure. Application services are now being brought up against the migrated databases, product by product, starting with Groovie. Payment processing for Groovie is confirmed working on the new infrastructure; we are reconciling any payment events that may have been missed during the disruption and will contact affected customers directly if any subscription or billing records need correction. Investigation into the scope of exposed credentials continues; no new findings on customer data at this time. Next update in the morning unless there is material news.
- October 22, 2026 at 3:22 PM ET
Migration underway. Groovie's payment and business services are now running on new infrastructure with payment processing confirmed working. Remaining Groovie components and all other products are being migrated in sequence. Backups of product databases have been secured. Investigation into the scope of exposed credentials continues; no new findings on customer data at this time.
- October 22, 2026 at 11:26 AM ET
Incident identified. Payment credentials rotated, misused API key disabled. Groovie and Voiceseal experiencing degraded service. Migration of all products to new infrastructure underway.