Security Incident
Adform provides advertising technology services used by many websites and other digital properties. We are publishing this notice to provide clear information to individuals who may have visited a website using Adform technology during a recent security incident.
What happened?
On 27 July 2026, Adform detected suspicious activity and immediately launched an investigation under its incident-response procedures. Once the cybersecurity threat was confirmed, we contained the incident, removed the malicious code, and took further measures to protect website visitors, our clients, and the Adform platform.
The malicious code was designed to interfere with certain cryptocurrency transactions involving Bitcoin, Ethereum, or Tron by attempting to replace a cryptocurrency wallet address copied to a user’s clipboard with a different address.
To our knowledge, the code was not designed to install software on a user’s device or establish persistence. It operated only while an affected webpage was open.
Based on our investigation to date, we have found no evidence that the malicious code transmitted users’ IP addresses or information about the websites they visited to an external party. Technical analysis indicates that such transmission may have been possible, and this aspect remains under investigation.
The incident has been contained, and Adform’s services are safe to use. Our investigation remains ongoing, and we continue to strengthen our security measures based on our findings.
What does this mean for website visitors?
The incident may have affected individuals who visited a website using the affected Adform technology on 27 July 2026.
As browsers may temporarily store website code, we recommend that individuals who visited an affected website clear their browser cache as a precaution.
This will clear the affected code from your browser. If you copied a Bitcoin, Ethereum, or Tron wallet address while one of the affected pages was open, please take a moment to check the address before you complete the transaction. It's a quick step, and it's worth doing.
What does this mean for Adform clients?
Adform has informed affected clients through dedicated communications and provided them with relevant information and recommended actions.
Clients should follow the guidance provided by Adform, clear any relevant caches under their control where applicable, and assess whether additional communication to their website visitors is appropriate.
The incident has been reported to the relevant authorities. We will continue to cooperate with our clients and the authorities and provide further information where appropriate.
We apologise for any concern or inconvenience caused.
For questions relating to this incident, please contact our support team at [email protected].