Is DUPR down right now? No. We re-checked on September 15, 2026: dupr.com loads and serves normally, and there is no maintenance or outage notice on it. The early-September outage ended around September 8. If you personally still can’t get in, that is most likely the separate login/MFA problem players have been reporting since the restore: what to try is here.

Last updated: 2026-09-15. Developing story. We update this page when new, verifiable information appears, and we log every change at the bottom.

DUPR (the Dynamic Universal Pickleball Rating, the system most competitive pickleball in the US runs on) had a security incident in early September 2026 and notified its users by email. The DUPR app and website were down for roughly two to three days, and service was restored around September 8, 2026.

This page is a plain summary of what is actually established, separated from what is only being reported. VolleyForge isn’t affiliated with DUPR, and we aren’t going to speculate about the cause, the scope, or anyone’s legal exposure. Where we don’t know something, we say so and leave it in the “unknown” column.

The short version

  • What happened: DUPR became aware of “suspicious activity” on its systems and opened an investigation into its nature and scope.
  • Why it went down: DUPR shut its own systems down “out of an abundance of caution.” The outage was the response, not the incident.
  • What DUPR said about data: it does not store financial, payment, or password data on its systems. It has not said what data, if any, was accessed.
  • Downtime: the app and website were unavailable for roughly two to three days.
  • Back online: service was restored by September 8, 2026, and DUPR says it has instituted upgraded security measures.
  • Watch out for: DUPR warned users about follow-on scam emails, texts, and phone calls impersonating DUPR: details below.
  • How it was disclosed: a September 8, 2026 email to users. As of this update there is still no incident post on DUPR’s blog or website.

Timeline

Still coarse at the front end, because DUPR has not published when the activity began or when it was detected, only that it “recently became aware” of it:

  • Unknown date, before September 6: the activity occurs and DUPR becomes aware of it. DUPR has not said when either happened.
  • Roughly two to three days: DUPR shuts its systems down as a precaution; the app and website are unavailable.
  • September 8, 2026: DUPR emails users. The email states the platform and app are back up, that upgraded security measures are already in place, and that the investigation into the activity’s nature and scope is under way.
  • As of September 15, 2026: that email is still the only disclosure we can find. There is no incident write-up on DUPR’s blog or site, and no follow-up on the investigation’s findings.

What DUPR said

We have now seen the notification email DUPR sent to its users, dated September 8, 2026. Quoting it directly, because paraphrasing a security notice is how detail gets lost. DUPR said it:

  • “recently became aware of suspicious activityon DUPR’s systems.”
  • “quickly shut everything down out of an abundance of caution and began an investigation into the nature and scopeof the activity.”
  • has the web platform and mobile app “back up and running.”
  • does “not store any financial, payment or password dataon our systems.”
  • has “already instituted upgraded security measures.”
  • wants users to “be cautious of any unexpected emails, text or phone calls claiming to be from DUPR” (see the phishing warning below).

Two things in that are worth pulling out, because they answer questions this page previously had to file under “unknown.” First, the downtime was DUPR’s own decision: a precautionary shutdown, not a crash or a capacity failure. Second, DUPR was investigating the scopeof the activity at the time it wrote, which means that as of September 8 it had not itself concluded what was or wasn’t reached.

And the thing the email still does notdo: it does not say what data, if any, was accessed. “Suspicious activity” with an investigation into its scope is not a statement that data was taken, and it is not a statement that none was. That single gap is why so much of the rest of this page sits in the “reported” and “unknown” sections instead of this one.

It is also worth being precise about the data point. “We don’t store financial, payment or password data” is a statement about what DUPR’s systems hold. It is not a statement that nothing else was touched, and it doesn’t tell you anything about accounts you hold elsewhere.

DUPR’s own warning: watch for follow-on scams

DUPR asked users to “be cautious of any unexpected emails, text or phone calls claiming to be from DUPR, especially if they are asking you for more sensitive information.”

This is the most actionable line in the whole notice, and it’s the one least likely to get repeated. After any incident at a company with a large user list, a second wave follows: messages that impersonate that company, reference the incident by name, and ask you to “verify” or “re-secure” your account. They work precisely because the underlying event is real and you were already expecting to hear something.

Two habits defuse nearly all of it:

  • Never act on a link in a message about an account. Open the app, or type dupr.com in yourself. A legitimate notice never loses anything by you arriving the long way.
  • Treat any request for “more sensitive information” as the tell. DUPR says it doesn’t store financial, payment, or password data. So a message claiming to be DUPR that asks for a card number, a password, or a verification code someone reads back to you is not DUPR. That includes phone calls.

This applies to us too: VolleyForge will never ask you for a DUPR password, and nothing on this page asks you to log in anywhere.

What players are reporting (not officially confirmed)

The following are user reports gathered from public discussion on r/Pickleball. DUPR has not confirmed any of them, and we are labeling them as reports for exactly that reason:

  • Login and MFA problems after the restore. Players on r/Pickleball report six-digit verification code emails that never arrive, or a login screen with no field to enter the code at all. Some report seeing a message that logins for club staff are currently disabled.
  • Recent matches that look missing. Players on r/Pickleball report that matches entered shortly before the outage never rating-calculated and now appear to be gone, including some matches from PPA events. In those same reports, ratings themselves appear to have survived. It is the recent match history that looks incomplete.
  • Assumptions about personal data. Because the email did not address what data was accessed, some players are inferring that basic profile information (name, email, phone, location) may have been exposed. That is a player inference, not a DUPR statement, and nobody has confirmed it.

Reports like these are useful signal and bad evidence. A dozen people describing the same login loop tells you something real is happening; it does not tell you why, how widespread it is, or whether anything is permanently lost.

What’s still unknown

Honestly, most of the questions people actually care about:

  • Whether any user data was accessed at all, and if so, which categories. DUPR said on September 8 that it was still investigating the scope; it has not published a finding since.
  • Whether the missing recent matches players describe are permanently lost, stuck in a rating-calculation queue, or restorable from backup.
  • When the activity began and when DUPR detected it. (What the response involved has moved out of this list. DUPR says it shut everything down as a precaution and has since upgraded its security measures.)
  • What “suspicious activity” refers to specifically: DUPR has not characterized it beyond that phrase.
  • Whether the login and MFA failures are a leftover of the restore or a deliberate, temporary lockdown.
  • Whether DUPR will publish a public post-incident write-up, and whether any formal user or regulator notification applies.

We are not filling those gaps with guesses. If you see claims circulating about who did it, how they did it, how many records were involved, or what the legal fallout will be. None of that is confirmed, and we won’t repeat it here. When DUPR publishes something fuller, we’ll update this page and link to DUPR’s own words.

What to do right now

Practical next steps, depending on who you are:

One piece of general security hygiene, which is good advice after anyapp incident and is not a claim about this one: if you reused a password across sites, change it, and turn on two-factor authentication wherever it’s offered. DUPR said it doesn’t store password data. That’s reassuring, and password reuse is still worth cleaning up regardless.

Keep your own record of your matches

The most durable lesson from this week has nothing to do with who was at fault. If the only copy of your season exists inside one third-party service, an outage at that service is an outage of your season.

That is fixable with very little effort. Screenshot or export your results after events. Organizers: keep a league-side record of every score as it’s submitted, so your standings don’t depend on anyone else’s uptime. The organizer playbook walks through exactly that. Players: keep your own list of who you played, when, and the score.

Where VolleyForge fits, and where it doesn’t

We should be straight about this, because it would be easy to overclaim during someone else’s bad week.

VolleyForge runs leagues and tournaments: schedules, score submission, and live standings that update as results come in. That part doesn’t depend on a third-party rating service being online, which is why an outage elsewhere doesn’t stop a VolleyForge season. You can browse open games and leagues near you. In Kansas City, start with the Kansas City pickleball hub, or read the organizer’s guide to running a league.

What VolleyForge is not: a DUPR replacement, and not a rating authority. Skill levels on VolleyForge are self-enteredtoday. We don’t sync with DUPR, we don’t calculate a competing rating, and we’re not affiliated with DUPR in any way. DUPR remains the de facto standard rating in the sport, and we hope it comes through this in good shape. A lot of players’ competitive records live there.

How we sourced this

Everything on this page comes from three places: the full text of DUPR’s September 8, 2026 notification email, provided to us by a DUPR user who received it; the same email as reproduced and discussed publicly by players on r/Pickleball; and DUPR’s own blog and website, which we checked on September 9, 10, and 15, 2026, and which carried no incident post on any of those dates.

Until September 15 we were working from the email secondhand and deliberately limited ourselves to two points from it. We now have the message itself, which is why this update quotes it directly and why several items moved out of the “unknown” column. We have not independently authenticated the email with DUPR; what we can say is that its contents match what players quoted publicly, and that it is consistent with the outage and restore we observed ourselves.

The rules we’re holding ourselves to, since this is a real incident at a real company:

  • We state as fact only what DUPR itself communicated, plus the observable outage and restore.
  • We attribute player reports as player reports, every time, and never promote them to fact.
  • We publish nothing about attacker identity, method, record counts, legal consequences, or whether specific data was stolen. None of that is established.
  • We don’t invent or paraphrase quotes from DUPR. Where we quote, it’s verbatim from the notification email and marked as a quote.
  • We don’t upgrade DUPR’s words. “Suspicious activity” under investigation is not a confirmed breach, and we don’t write it as one.

Update log

  • 2026-09-15 (second update): we obtained the full text of DUPR’s notification email from a user who received it, dated September 8, 2026. Previously we only had it secondhand via r/Pickleball and held ourselves to two points from it. Four things changed as a result: the outage is now established as DUPR’s own precautionary shutdown rather than an unexplained failure; DUPR says it has already instituted upgraded security measures; DUPR was still investigating the scopeof the activity as of the 8th; and we added DUPR’s warning about impersonation scams, which we had been missing entirely. The email still does not say what data, if any, was accessed, so the “unknown” section keeps that question.
  • 2026-09-15: re-verified, nothing material has changed. dupr.com returns a normal page with no maintenance or outage notice, so the service is up. DUPR’s blog still carries no incident post, five days on. The email to users remains the only disclosure we can find. We added the status line at the top of this page because people are still arriving here asking whether DUPR is down right now, and that question deserves a current answer rather than one dated a week ago.
  • 2026-09-10: first published. Facts re-verified against DUPR’s site and r/Pickleball on the publish date: DUPR still has no public statement on its blog or site, and service appears largely restored.

If DUPR issues a fuller statement or an incident-response summary, we’ll add it here and move anything it confirms out of the “reported” section. Until then, the honest answer to “what data was taken?” is that nobody outside DUPR knows.