Security Notice: Help Site Incident August 11–12, 2026
Table of Contents
What happened
On August 11–12, 2026, a third-party contractor account used by our help site provider, Helpjuice, was compromised. An unauthorized script was injected into a subset of Helpjuice-hosted knowledge bases, including the knowledge base they host for us. The script displayed a fake CAPTCHA prompt that instructed visitors to run a "verification command" on their own device. Our own systems were not compromised.
The script was active on our help site between August 11 at 22:26 UTC and August 12 at 11:04 UTC. It has since been fully removed. Helpjuice has confirmed there is no evidence that any articles, user accounts, or files were accessed or exported.
Are you affected?
You are only potentially affected if both of the following are true:
- You visited our help site during the window above, and
- You saw a CAPTCHA prompt and ran the "verification command" it displayed
If you visited but did not run the command, no action is needed.
What to do if you ran the command:
- Scan your device for malware using your preferred security or antivirus tool.
- Change any passwords you may have entered or used on that device during or after that session.
Questions?
If you have questions or concerns, please reach out to our support team at help@change.org. We're happy to help.