EU Data Ingestion Disruption - June 29-30, 2026

Final update

Incident Duration: June 29, 08:00 UTC – June 30, 09:30 UTC (~26 hours) Affected Services: Datatube EU Production - West Europe region Affected Products: CloudGuard WAF, Playblocks, XDR ──────────────────────────── Overview On June 29–30, 2026, EU production Datatube services experienced a partial degradation affecting data ingestion in the West Europe region, a small portion of events experienced delayed processing during this window. ──────────────────────────── Customer Impact During the incident window, approximately ~0.2% of total EU ingestion events were affected across products. Customers using CloudGuard WAF, Playblocks, or XDR in the West Europe region may have experienced: - Delayed visibility of security events in dashboards and reports - Delayed data in queries covering the June 29–30 window ──────────────────────────── Incident Timeline (UTC) Jun 29 – 08:00 First customer reports received; investigation initiated immediately, cross-team investigation mobilized across infrastructure, networking, and product teams. Jun 29 – 10:00 First mitigation applied - provided temporary partial relief. Jun 29 – 13:30 Second mitigation applied, narrowing the root cause scope further,

1. Resolved · Jun 29, 08:00 UTC
   Incident Duration: June 29, 08:00 UTC – June 30, 09:30 UTC (~26 hours) Affected Services: Datatube EU Production - West Europe region Affected Products: CloudGuard WAF, Playblocks, XDR ──────────────────────────── Overview On June 29–30, 2026, EU production Datatube services experienced a partial degradation affecting data ingestion in the West Europe region, a small portion of events experienced delayed processing during this window. ──────────────────────────── Customer Impact During the incident window, approximately ~0.2% of total EU ingestion events were affected across products. Customers using CloudGuard WAF, Playblocks, or XDR in the West Europe region may have experienced: - Delayed visibility of security events in dashboards and reports - Delayed data in queries covering the June 29–30 window ──────────────────────────── Incident Timeline (UTC) Jun 29 – 08:00 First customer reports received; investigation initiated immediately, cross-team investigation mobilized across infrastructure, networking, and product teams. Jun 29 – 10:00 First mitigation applied - provided temporary partial relief. Jun 29 – 13:30 Second mitigation applied, narrowing the root cause scope further, also provided temporary partial relief. Jun 29 – 18:00 Issue confirmed as affecting multiple products; joint investigation continued. Jun 29 – 21:15 Capacity expanded to stabilize the environment and protect against further degradation. Jun 30 – 05:00 Final diagnostic steps executed to isolate root