SignalPlus Reimbursed 23 Users $81,897 After Nov. 4 Attack

SignalPlus reimbursed 23 users a total of $81,897 within 72 hours after detecting unusual activity on Nov. 4, according to the platform, completing its pledge to compensate users affected by the attack.

The disclosed $81,897 represents reimbursements to the 23 covered users, not a stated total for assets stolen or broader losses. That distinction leaves the confirmed financial figure tied to the compensation program while the company works through the causes of the incident and the restoration of affected services.

What caused the Nov. 4 attack?

SignalPlus attributed the attack to a compromised third-party Telegram account. The company said, "accounts without IP allowlists were affected." An IP allowlist restricts access to approved network addresses. SignalPlus did not say that the missing control alone caused the incident; it presented the compromised third-party account and the absence of allowlists as features of the affected environment.

SignalPlus did not identify the third-party account or disclose how the Telegram account was compromised. Its disclosure establishes the compromised-account finding and the allowlist gap, but does not provide a detailed attack path.

How quickly did reimbursements reach users?

SignalPlus detected unusual activity on Nov. 4 and completed the reimbursements within 72 hours. The platform paid 23 users a combined $81,897 during that period, fulfilling the compensation commitment it had made to affected users. The timetable placed the cash outlay ahead of the longer review and service-restoration work.

This was not a full operational return. SignalPlus paused affected services as it began its security review, and the speed of the payments did not remove the need to examine access controls and restore those services safely. The company’s disclosure separates a completed reimbursement process from an unfinished recovery process.

What action followed the detection?

After identifying unusual activity, SignalPlus notified partner exchanges and pushed them to suspend API keys related to the incident. It also paused affected services, started a security review, and contacted affected users to complete verification while the investigation continued.

Suspending an API key removes that credential’s use for automated access, while an IP allowlist controls which network addresses may connect. The request to partner exchanges sought to extend containment beyond SignalPlus’s own systems and addressed two access layers: credentials and permitted network locations.

Which security controls are changing?

SignalPlus said it is:

• Raising API access requirements.
• Adding IP allowlist checks.
• Tightening controls on employee devices and internal access.

Those changes target the layers identified in its incident account: external API entry, network-address restrictions, and staff access. The company also said it would complete a system review and make upgrades before bringing affected services back.

SignalPlus has completed the compensation phase: it paid $81,897 to 23 users. Its recovery phase remains open because affected services are paused while the company reviews systems, raises API access requirements, and tightens controls on employee devices and internal access.

SignalPlus said, "Services are expected to resume gradually after the system review and upgrades are complete." No firm restoration date accompanied the disclosure, so the relevant deadline is not a calendar-day reopening but completion of the review and control upgrades that precede the gradual return.

No firm reopening date was provided; the next enforcement window is the point at which stricter API, allowlist, employee-device and internal-access controls take effect, after which SignalPlus plans to restore affected services gradually.