# CRITICAL issue!

**URL:** <https://community.retellai.com/t/critical-issue/2313>\
**Category:** Support Help\
**Tags:** bug\
**Created:** [April 12, 2026, 6:17pm UTC](https://community.retellai.com/t/critical-issue/2313 "2026-04-12T18:17:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![itdep](https://yyz2.discourse-cdn.com/flex008/user_avatar/community.retellai.com/itdep/32/759_2.png) [@itdep](https://community.retellai.com/u/itdep)\
**Post date:** [April 12, 2026, 6:17pm UTC](https://community.retellai.com/t/critical-issue/2313/1 "2026-04-12T18:17:26Z")

</div>

We received a large number of outbound calls to a large number of phone numbers (a massive spam attack); I think this was due to a lost API key. Please send me the details of the call call\_793c67944f8d6db24b1c8f122e7—how it was initiated, which API key was used, the IP address from which it was made, and any other important information that will help me understand the cause and resolve the issue to stop the spam attack. Please send the information to the Workspace account email. The Workspace in question is org\_aCYwH7oYQ2lneKGd

---

<div class="post-metadata">

**Author:** ![Shah-Fazal](https://yyz2.discourse-cdn.com/flex008/user_avatar/community.retellai.com/shah-fazal/32/2522_2.png) [@Shah-Fazal](https://community.retellai.com/u/Shah-Fazal)\
**Post date:** [April 13, 2026, 1:23pm UTC](https://community.retellai.com/t/critical-issue/2313/2 "2026-04-13T13:23:19Z")

</div>

Hi @itdep

Thanks for reporting that. I’ve shared the call details with the team and asked them to review what can be done. Once we receive a response, we’ll update you accordingly.

Thank You

---

<div class="post-metadata">

**Author:** ![Shah-Fazal](https://yyz2.discourse-cdn.com/flex008/user_avatar/community.retellai.com/shah-fazal/32/2522_2.png) [@Shah-Fazal](https://community.retellai.com/u/Shah-Fazal)\
**Post date:** [April 13, 2026, 1:48pm UTC](https://community.retellai.com/t/critical-issue/2313/3 "2026-04-13T13:48:11Z")

</div>

Hi @itdep

- The attack ran from approximately 07:36 UTC to 18:15 UTC on April 12.
- All calls were initiated via the API using your API key `key_798c...01ba` from IP address 54.211.17.79
- The calls used your phone number `+1249468xxxx` and primarily targeted two of your agents.

What we recommend:

1. Rotate all API keys — If you have any API keys, regenerate them immediately as a precaution.
2. Enable IP allowlisting — If you use the API from known servers, consider restricting API access to specific IP ranges.

The originating IP of the attack was 54.211.17.79. Unfortunately, we do not log additional details beyond the IP and API key for call creation requests, but this information should help you investigate further.

Thank You