On April 20, 2026, we identified that our support website www.universal-robots.com/support had been compromised by an unauthorized third party. Here you will further information and support on this event. 

I saw a pop-up or browser warning on the UR support site - what should I do?
The alert you saw was fake. It was placed there by the threat actor and has no connection to Universal Robots or the actual state of your device. If you saw the alert but did not click any links, download anything, or run any commands, please still take the general precautions listed below as a matter of good practice.

I clicked a link, downloaded a file, or ran a command shown in the alert-what should I do?
Please treat this seriously and act as soon as possible. This malware framework is designed to silently extract data from your device if the command or download was executed. We recommend the following steps without delay:

1. Inform your IT or security team immediately that your device may be compromised. Do not wait, early action significantly limits potential damage. 
2. Run a full scan using a reputable, up-to-date endpoint security product. However, be aware that this malware is designed to run in memory and may evade standard antivirus detection. Your IT team may need to conduct a deeper investigation.
3. Assume that any passwords, session cookies, saved payment details, and credentials stored in your browser may have been exfiltrated. Change passwords for all accounts accessible from that device immediately, prioritizing email, banking, and any corporate systems.
4. Revoke and refresh any active session tokens or API keys accessible from the affected device.
5. Monitor your accounts closely for any unusual or unauthorized activity.
6. If you granted remote access to your device at any point following the alert, disconnect from the internet immediately and contact your IT team.

I have received a suspicious email claiming to be from Universal Robots or UR Support- whatshould I do?
Please be vigilant. Following incidents of this nature, it is common for threat actors to conduct follow-up phishing campaigns impersonating the affected organization. If you receive an email purporting to be from Universal Robots or UR Support:

• Do not click any links or open any attachments until you have verified the sender's email address carefully, looking for subtle misspellings or unusual domains.
• When in doubt, navigate directly to www.universal-robots.com rather than following any link in the email.
• If you are unsure whether communication is genuine, contact us directly through our official website to verify.

I received a phone call from someone claiming to be UR Support-is it genuine?
Universal Robots will not make unsolicited calls to customers asking for remote access to devices, account credentials, or payment information. If you receive such a call, do not provide any information and end the call. You can verify any communication by contacting us directly through our official website.

What else should I do to stay protected?
We recommend the following general precautions in light of this incident:

• Change your password for any account you hold on the UR support site as a precaution, and avoid reusing that password on other services.
• Enable multi-factor authentication (MFA) on your accounts where available.
• Keep your operating system, browser, and security software fully up to date.
• Be alert to any unusual activity on accounts or devices you used to access the UR support site during the affected window.
• If your organization has a security or IT team, inform them that you accessed the site during the 16:15–19:23 UTC window on 20 April so they can take appropriate precautionary action, even if you did not interact with any alert.

OUR COMMITMENT TO YOU

We recognize the concern that an incident of this nature causes, and we sincerely apologize for the disruption and worry this may have caused. If you have questions or concerns related to this incident, please contact us at info@universal-robots.com.