Users received confirmation emails about support tickets they never created (phishing attack)

Situation

Around October 15, 2025, users started seeing suspicious support tickets that appeared in their JetBrains support profile that they did not create or submit themselves. Prior to that, they also received confirmation emails about the creation of such tickets.

An example of such ticket in the JetBrains support profile:

Question

How did this happen? Has there been any unauthorized activity associated with the affected JetBrains accounts or support profiles?

Answer

It was a phishing attempt. But we can assure you that no one has unauthorized access to your profile or account.

Explanation

There is a JetBrains-hosted website where users can submit any questions about our products, and the questions are then sent to our Help Center as new support tickets.

On this website, users need to fill in their username, email address, ask the question, and then submit the form. Once our system receives a question, it automatically sends a confirmation email to the user to let them know we have received their request and that our support engineers will reply shortly.

What happened is that an attacker submitted fake support requests from this website using email addresses obtained from external sources (such as scraped public data or compromised email lists).

As a result, users may have received an unexpected email from our support system, which could appear to be from a legitimate source (such as Discord in the example case above), and may contain suspicious links.

⚠️ If you received such an email, we strongly advise not to click any links and to delete the message immediately.

Please rest assured that:

• Your account with us has not been compromised
• No unauthorized access was gained to our systems or customer data

Who else is affected?

The issue is not specific to JetBrains and has affected many other companies who use ZenDesk (example). Here's a recent response on the subject from a Zendesk representative:

Brett here from the Zendesk Community Team! Thanks so much for bringing this to our attention. I can confirm that our security teams are currently looking into this. In the meantime, I recommend reaching out to our support team directly. This will help them track the accounts affected by this activity, determine the scale of the issue, and follow up with you privately through a support ticket. We’ll continue to monitor this thread, but please understand that we’re limited in what we can share publicly. Our goal is to keep your accounts secure by avoiding the release of any information that could be misused.

Next steps

Our IT team is currently investigating the matter to determine possible solutions - for example, adding a CAPTCHA to the submission form to prevent abuse.

Should you have any other questions or concerns, please don't hesitate to voice them here.

Thank you for your attention and continued trust.