Last updated: 2026-09-10 — developing story. We update this page when new, verifiable information appears, and we log every change at the bottom.

DUPR — the Dynamic Universal Pickleball Rating, the system most competitive pickleball in the US runs on — had a security incident in early September 2026 and notified its users by email. The DUPR app and website were down for roughly two to three days, and service was restored around September 8, 2026.

This page is a plain summary of what is actually established, separated from what is only being reported. VolleyForge isn’t affiliated with DUPR, and we aren’t going to speculate about the cause, the scope, or anyone’s legal exposure. Where we don’t know something, we say so and leave it in the “unknown” column.

The short version

  • What happened: a security incident at DUPR, disclosed to users by email in early September 2026.
  • What DUPR said about data: its email stated that DUPR does not store financial, payment, or password data on its systems.
  • Downtime: the app and website were unavailable for roughly two to three days.
  • Back online: service was restored around September 8, 2026.
  • How it was disclosed: email only. As of this update there is no incident post on DUPR’s blog or website.

Timeline

Deliberately coarse, because precise timestamps haven’t been published by DUPR:

  • Early September 2026 — DUPR emails users about a security incident.
  • Roughly two to three days — the DUPR app and website are down.
  • Around September 8, 2026 — service is restored and players can reach the app and site again.
  • As of September 10, 2026 — the email is still the only disclosure we can find, and there is no incident write-up on DUPR’s blog or site. That could change if DUPR publishes a fuller statement later.

What DUPR said

Two points, both from the email DUPR sent to its users:

  1. There was a security incident.
  2. DUPR does not store financial, payment, or password data on its systems.

We are not quoting that email or paraphrasing it beyond those two points, and we are not putting words in DUPR’s mouth. The important thing to notice is what the email didnotdo: as far as we can tell, it did not spell out what data, if any, was accessed. That single gap is why so much of the rest of this page sits in the “reported” and “unknown” sections instead of this one.

It is also worth being precise about the second point. “We don’t store password data” is a statement about DUPR’s systems. It is not a statement that nothing else was touched, and it doesn’t tell you anything about accounts you hold elsewhere.

What players are reporting (not officially confirmed)

The following are user reports gathered from public discussion on r/Pickleball. DUPR has not confirmed any of them, and we are labeling them as reports for exactly that reason:

  • Login and MFA problems after the restore. Players on r/Pickleball report six-digit verification code emails that never arrive, or a login screen with no field to enter the code at all. Some report seeing a message that logins for club staff are currently disabled.
  • Recent matches that look missing. Players on r/Pickleball report that matches entered shortly before the outage never rating-calculated and now appear to be gone, including some matches from PPA events. In those same reports, ratings themselves appear to have survived — it is the recent match history that looks incomplete.
  • Assumptions about personal data. Because the email did not address what data was accessed, some players are inferring that basic profile information — name, email, phone, location — may have been exposed. That is a player inference, not a DUPR statement, and nobody has confirmed it.

Reports like these are useful signal and bad evidence. A dozen people describing the same login loop tells you something real is happening; it does not tell you why, how widespread it is, or whether anything is permanently lost.

What’s still unknown

Honestly, most of the questions people actually care about:

  • Whether any user data was accessed at all, and if so, which categories.
  • Whether the missing recent matches players describe are permanently lost, stuck in a rating-calculation queue, or restorable from backup.
  • When the incident started, when DUPR detected it, and what the response involved.
  • Whether the login and MFA failures are a leftover of the restore or a deliberate, temporary lockdown.
  • Whether DUPR will publish a public post-incident write-up, and whether any formal user or regulator notification applies.

We are not filling those gaps with guesses. If you see claims circulating about who did it, how they did it, how many records were involved, or what the legal fallout will be — none of that is confirmed, and we won’t repeat it here. When DUPR publishes something fuller, we’ll update this page and link to DUPR’s own words.

What to do right now

Practical next steps, depending on who you are:

One piece of general security hygiene, which is good advice after anyapp incident and is not a claim about this one: if you reused a password across sites, change it, and turn on two-factor authentication wherever it’s offered. DUPR said it doesn’t store password data — that’s reassuring, and password reuse is still worth cleaning up regardless.

Keep your own record of your matches

The most durable lesson from this week has nothing to do with who was at fault. If the only copy of your season exists inside one third-party service, an outage at that service is an outage of your season.

That is fixable with very little effort. Screenshot or export your results after events. Organizers: keep a league-side record of every score as it’s submitted, so your standings don’t depend on anyone else’s uptime — the organizer playbook walks through exactly that. Players: keep your own list of who you played, when, and the score.

Where VolleyForge fits — and where it doesn’t

We should be straight about this, because it would be easy to overclaim during someone else’s bad week.

VolleyForge runs leagues and tournaments: schedules, score submission, and live standings that update as results come in. That part doesn’t depend on a third-party rating service being online, which is why an outage elsewhere doesn’t stop a VolleyForge season. You can browse open games and leagues near you — in Kansas City, start with the Kansas City pickleball hub — or read the organizer’s guide to running a league.

What VolleyForge is not: a DUPR replacement, and not a rating authority. Skill levels on VolleyForge are self-enteredtoday. We don’t sync with DUPR, we don’t calculate a competing rating, and we’re not affiliated with DUPR in any way. DUPR remains the de facto standard rating in the sport, and we hope it comes through this in good shape — a lot of players’ competitive records live there.

How we sourced this

Everything on this page comes from two places: DUPR’s email to its users, as reproduced and discussed publicly by players on r/Pickleball, and DUPR’s own blog and website, which we checked on September 9 and again on September 10, 2026, and which carried no incident post at that time.

The rules we’re holding ourselves to, since this is a real incident at a real company:

  • We state as fact only what DUPR itself communicated, plus the observable outage and restore.
  • We attribute player reports as player reports, every time, and never promote them to fact.
  • We publish nothing about attacker identity, method, record counts, legal consequences, or whether specific data was stolen — none of that is established.
  • We don’t invent or paraphrase quotes from DUPR.

Update log

  • 2026-09-09 — first published: timeline, what DUPR’s email said, attributed player reports, and the open questions.
  • 2026-09-10 — re-verified before publishing: DUPR still has no public statement on its blog or site, and service appears largely restored. No facts changed.

If DUPR issues a fuller statement or an incident-response summary, we’ll add it here and move anything it confirms out of the “reported” section. Until then, the honest answer to “what data was taken?” is that nobody outside DUPR knows.