Cyber Incident Victim: Notion
Date:
Feb 2021
Location:
United States of America
Summary
Notion experienced a widespread service disruption due to a DNS issue, rendering its collaborative workspace platform inaccessible and preventing users from retrieving cloud-stored data. The outage stemmed from a domain misconfiguration affecting website resolution, prompting the company to engage its domain host Name.com for resolution while publicly acknowledging the incident via social media and status updates without specifying the root cause.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 12, 2021, Notion, an online workspace startup valued at over $2 billion, experienced a widespread service outage beginning around 9 a.m. Eastern Time. The collaborative platform became inaccessible to users globally, preventing them from retrieving cloud-stored documents or accessing workspace functionalities. Notion initially communicated the disruption through a since-deleted tweet inquiring whether any users had contacts at Name.com, its domain hosting provider. The company subsequently issued a public statement confirming a DNS (Domain Name System) issue was preventing the resolution of its website for many users. DNS translates human-readable web addresses into machine-readable IP addresses essential for locating internet resources. A misconfiguration in Notion’s DNS settings caused its primary domain (notion.so) to resolve to no valid IP address, rendering the service unreachable despite its servers likely remaining operational.
Name.com, the domain registrar implicated in the incident, publicly responded to Notion’s tweet stating it was collaborating with the company to resolve the issue urgently. Notion requested clarification on where Name.com was sending messages to coordinate troubleshooting efforts, indicating potential communication challenges during the response. The company directed users to its Twitter status page for updates while investigating the root cause of the DNS misconfiguration. The outage disrupted business and personal workflows for Notion’s user base, which relied on the platform for real-time document collaboration and cloud data storage. No evidence suggested malicious actor involvement or data compromise; the disruption stemmed solely from technical misconfiguration. Notion did not disclose the outage’s duration, specific configuration error, or full restoration timeline in the available reporting period.