Security incident, 3 support tickets with zero response in 3 weeks

Question

We are a paying Atlassian Cloud customer (Jira Premium, Confluence Standard, Jira Service Management, roughly 45 users), and we have a security issue that Atlassian support has not acknowledged in three weeks. Is this normal?

A former employee, whose account was suspended in our organization, somehow used his Atlassian login to create a second, unauthorized organization using our company name, and invited several of our current employees as organization admins. We do not control that organization, did not create it, and it is using our company identity. We have deactivated his managed account on our side, but we cannot remove or shut down the duplicate organization ourselves.

What we have done: we submitted three separate support tickets through support.atlassian.com. We have not received a single reply, not even an automated acknowledgment from a human. We also reported the unauthorized organization through the abuse reporting channel.

We pay a significant amount for these products, including a Premium plan that advertises faster response times, and three weeks of silence on a security issue involving unauthorized access and impersonation of our company is not acceptable. There is also no way to set a severity when submitting a ticket, so we have no means of flagging the urgency ourselves.

Can an Atlassian staff member please pick this up and escalate internally? I am happy to share organization IDs and account details privately.

Trudy P Claspill · Accepted Answer

Hello @Colin Page

Welcome to the Atlassian community.

Are you able to access the three support tickets you say have been submitted? Have you added comments to the to request a response?

As a user community we don't have the ability to access your support cases. I can flag your post to raise it to the attention of Atlassian team members, which I will do.

Martin Runge · Accepted Answer

Hi @Colin Page,

Your current employees who were invited to serve as org admins for the unauthorized organization have real control over it. I’d suggest asking one of them to sign in at admin.atlassian.com, switch to the new organization, and check what’s set up there. If there are no sites or products, it’s likely just an empty shell. They can then remove the former employee’s admin role, so no one outside your control is managing it. Please save screenshots documenting this step so Atlassian can see that you acted in good faith.

In your real organization, I would check these points right away:

* Settings > Domains: make sure your company domain is verified there. A domain can only be verified in one organization, so this blocks the other org from claiming it.
* Directory > Users: open the former employee’s managed account and revoke any API tokens.
* Insights > Audit log: look for activity from his account before the deactivation.
* Check every product for guest or external accounts he might still use with a private email address.

Cheers, Martin

Arkadiusz Wroblewski · Accepted Answer

Hello Colin

Three weeks without a response to a potential security incident is certainly concerning.

I also recommend contacting security@atlassian.com directly, referencing your existing support tickets and explaining the unauthorized organization's situation.

https://www.atlassian.com/trust/security/security-incident-management

Please share organization IDs and sensitive details privately.

Hopefully, Atlassian can investigate this promptly. Trudy request for assistance should do the work, though.

Best,

Arek🤠🧙‍♂️

Colin Page · Accepted Answer

@Trudy P Claspill Thank you for escalating. That seems to have done the trick. I had a support representative reach out to me this morning regarding this matter. I will reply back if there are any other issues related to this ticket.

Thank you all for your helpful comments!

Samuil Enchev · Accepted Answer

Hi @Colin Page,

Following Trudy's escalation, I reached out to the Security team internally and bumped your case.

Please expect communication from the team in the SECREP-29388 ticket.

Best,

Samuil