Title: Datto EDR - US infocyte.com performance degradation and intermittent outages – 2026-04-17
Summary: Between 2026-04-17 09:30 UTC and 2026-04-18 04:00 UTC, Datto EDR customers in the US region experienced slow application performance, elevated latency, and intermittent service availability issues. Service degradation occurred as backend services became overloaded, resulting in periods of reduced platform responsiveness and intermittent outages.
Root Cause: A newly released AMSI-related feature generated substantially more traffic than anticipated from approximately 1.8 million agents. Requests to an AMSI keywords endpoint were not sufficiently optimized and resulted in excessive database activity. At the same time, a newly introduced AMSI detection rule increased processing overhead on backend services. The combined load created resource contention that led to application instability, infrastructure stress, and intermittent service disruption within the US Datto EDR environment.
Incident Timeline:
Identified: 2026-04-17 09:30 UTC
Public Notification: 2026-04-17 09:30 UTC (incident declared and customer communications initiated)
Resolved: 2026-04-18 04:00 UTC (permanent hotfix deployed and service performance restored)
Preventative Measures: To reduce the likelihood and impact of similar incidents in the future, we are taking the following steps:
Enhancements to Infrastructure Resiliency: Implemented server-side caching for AMSI keyword data to significantly reduce backend processing and database load associated with agent requests.
Enhancements to Infrastructure Resiliency: Introduced randomized timing controls for agent communications to prevent large synchronized traffic spikes following updates and deployments.
Enhancements to Release Management Practices: Improved AMSI agent functionality to reduce unnecessary requests during service restarts and update scenarios, lowering overall platform load.
Enhancements to Release Management Practices: Introducing additional scale and load-impact reviews for future features that increase agent communication frequency or backend processing requirements.
Enhancements to Monitoring and Alerting: Expanding visibility into high-volume service endpoints and traffic patterns to accelerate identification and remediation of abnormal load conditions.