On December 3, 2025, at 13:30 UTC, the Lucidworks SaaS Platform experienced widespread service disruptions affecting multiple clients. This issue affected Lucidworks AI functionality (including Neural Hybrid Search), Commerce Studio and Analytics Studio accessibility, and Connected Search. API requests received HTTP 401 and 403 errors with invalid or expired token messages, and the platform.lucidworks.com UI became inaccessible. During this time, Lucidworks infrastructure also experienced a high volume of malicious traffic from external sources.
Lucidworks Engineering resolved the issue by 22:03 UTC on December 3, 2025, restoring service for all affected products.
A similar issue occurred on December 5, 2025, beginning at 16:17 UTC. Following further coordination with our third-party identity provider (explained in detail below), this repeat incident was resolved by 19:00 UTC that day.
The incident was caused by a combination of three interconnected issues that occurred simultaneously on December 3, 2025. Okta, Lucidworks' identity provider for Platform authentication, experienced a service outage, and in response implemented aggressive rate-limiting measures. During this period, Lucidworks Platform IP addresses were blocked by Okta for an extended duration, preventing the Lucidworks authentication system from retrieving JSON Web Key Sets (JWKS) from Okta's servers. This resulted in HTTP 401 invalid/expired token errors for authentication requests.
Concurrent with the Okta outage, Lucidworks Platform infrastructure experienced a distributed denial of service (DDoS) attack in the form of a high rate of malicious requests from multiple geographic sources. The attack traffic significantly exceeded Okta's rate limit thresholds and contributed to Okta's decision to block the Lucidworks Platform IP addresses.
Additionally, for some Lucidworks Search customers, a configuration flag (failOnError) in the Core Package vectorization stage was inadvertently left enabled in the Production environment following earlier debugging activities. When the Okta authentication issue prevented access to Lucidworks AI services, queries using Neural Hybrid Search failed completely rather than falling back to lexical-only search, amplifying the impact for clients using Neural Hybrid Search functionality.
Lucidworks determined the root causes through analysis of Okta service status, review of authentication logs showing JWKS retrieval failures, traffic analysis identifying the DDoS attack pattern, coordination with Okta support, and code review of affected query pipeline configurations. Changing the Lucidworks Platform IP address immediately restored authentication functionality, confirming that Okta's IP blocking was the primary cause of the authentication failures.
Two days later, on December 5, 2025, the Lucidworks Platform again began to experience 401 invalid/expired token errors for authentication requests. We again had to coordinate with Okta support to update their IP address allowlist in order to ensure our traffic was not blocked or unnecessarily rate-limited.
Lucidworks has taken the following actions as a result of this incident:
failOnError flag and enable automatic lexical-only fallback when vectorization services are unavailableAdditionally, we intend to take the following actions to further enhance our ability to detect, withstand, and respond to similar incidents in the future:
Lucidworks recommends that all clients using Neural Hybrid Search upgrade to Fusion 5.9.15 or later as soon as possible. This version includes enhanced failsafe fallback mechanisms in the Neural Hybrid Query stage that automatically switch to lexical-only queries when Lucidworks AI services are unreachable, improving overall system resilience during service disruptions.
Lucidworks also recommends that clients subscribe to Lucidworks status updates to receive real-time notifications about Lucidworks SaaS Platform incidents. To enable this feature, click Subscribe to Updates on status.lucidworks.com.