Polymarket Outages Tied to Third-Party Cyberattack, Company Confirms

Key points

• Polymarket experienced availability problems beginning Thursday afternoon.
• The company attributed the disruption to a cyberattack involving an unnamed third party.
• The attackers have not been identified.
• The incident highlights dependency risk from outside service providers.

Polymarket acknowledged that its platform suffered availability problems beginning Thursday shortly after 2 p.m. Eastern time. According to the company, the disruption was linked to a cyberattack that involved an unnamed outside provider. The attackers behind the incident have not been identified.

The impact fell on Polymarket users and on the platform’s normal operations, which experienced downtime during the disruption. Because the company pointed to an outside provider, the event also raises questions about how far the affected dependency extends and whether other services relying on the same vendor could face similar exposure.

The incident matters because third-party relationships are a common path for operational disruption. Even when an organization’s own systems are not directly breached, a compromise at a vendor can interrupt availability and complicate incident response. Polymarket’s confirmation that the outages were attributed to a cyberattack makes the event more than a routine service failure, though details about the provider and the attack method remain limited.

What to watch next includes whether Polymarket identifies the outside provider, how quickly full service is restored, and whether the attackers or their motivation become known. Organizations that depend on external platforms should use the event as a reminder to review vendor contingency plans, monitor service-level commitments, and prepare for disruptions that originate outside their own environment.

What to do now

1. Inventory critical third-party providers and document which business services depend on each one.
2. Confirm vendor incident-reporting contacts and escalation paths before the next disruption.
3. Review contracts for availability commitments, breach notification timelines, and recovery obligations.
4. Segment access to external providers and apply least-privilege controls to reduce blast radius.
5. Test contingency plans for losing a key vendor, including manual workarounds and communication templates.
6. Monitor platform availability and vendor status channels so outages are detected and communicated quickly.
7. Conduct a post-incident review once details are available and update third-party risk assessments accordingly.

Original source

The Record