Family Member account got deleted on rejecting confirmation

shankars

Hello,
I have an active subscription to 1Password Family and three people were using including myself.
Logged-onto 1Password cloud today after a long time and under people i saw an unusual message "waiting for confirmation" on one of the family member account. On seeing this, the understanding was that the family member wasn't using the account and under actions, there was an option to Reject. I clicked Reject and the next second to my shock, the family member account got deleted with all data/vault.
As per 1Password documentation/user-manual, the only way to delete an account is to first suspend the account and after that if the delete action is selected, the user is prompted to enter name with a warning and only on approving, the account should get deleted.
No where there is any information that "Reject" action would automatically trigger a delete and wipe out the entire data.

Given that 1Password allowed the family member to use the application even though I(owner) hadn't confirmed, then on Reject, deleting the account and wiping out the data has no logic! Atleast a confirmation with a detail message should have got prompted.

How can we recover that family member account and vault/data ?
Requesting your urgent help!!!

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided

ag_ana

Hi @shankars!

We will be happy to help you with this. To avoid sharing your account information here, can you send us an email to support+forum@agilebits.com from your account's registered email address so we can continue the conversation there?

After you have sent the email, please post the ticket number you received so we can locate your message and connect it with this forum discussion.

Looking forward to your message!

shankars

Hi @ag_ana ,

Thanks for the response!
I sent the mail yesterday itself from 1Password support to "support+security@1password.com".
Received a response today with ticket number #UIP-35591-469
Our life has literally come to a standstill due to this incident.
Deeply appreciate if you could expedite/fast-track the resolution to this issue.

Ben

Thanks @shankars. I see our security team has received and is reviewing your email. They'll be in touch via email ASAP.

Ben

ref: UIP-35591-469

shankars

Thanks @Ben

ag_ana

:+1: :)

Ben

A small update here, @shankars. Our security team had to do additional research on this as the account was not deleted through the normal method. It was deleted before it was fully created. The normal process for an account to be created within a membership is:

1. Invitation is sent by family organizer
2. Invitation is accepted by family member, and account creation process is started. This establishes the member's Personal vault, but does not grant them access to the Shared vault, or any other vaults within the membership.
3. Account creation is completed by the family organizer, who confirms the process started in step 2.

What happened here is that instead of step 3 following the normal path, the account creation was rejected by a family organizer. This is a very different state than an account which has been fully created and then later deleted.

The team is still working out the final details of the situation and what, if any, options are available for recovery from this state. They'll be in touch via email with further, but I wanted to let you know we haven't forgotten about this and are still working toward providing the best possible outcome here.

Thank you.

Ben

shankars

Thanks @Ben for the update and explaining the process in steps.
Deeply appreciate and look forward for the technical team to recover the account from this state.

ag_ana

On behalf of Ben, you are very welcome :+1: :)