Business account deleted on 28 Aug - 1Password says "by an account owner", but no owner did it
Hi all,
Our 1Password Business account (EU tenant) was deleted on Friday
28 August 2026 at 11:46:58 UTC. Nobody on our team initiated it.
What we've established from our own logs and the notification emails:
- The deletion email states the account was deleted "von einem
Kontobesitzer" (by an account owner).
- Our desktop client logged the removal at exactly 11:46:58 UTC with
UnableToCreateClient(UserDeleted).
- A renewal invoice arrived the same day, so the subscription was
active. This was not a billing lapse.
- The emails are genuine - correct sender, passing authentication.
Not phishing.
- Deletion required clicking a confirmation button emailed to our
account address within 24 hours, so this was a deliberate two-step
action by someone.
- Our admin's machine shows no browser activity during that window
and no visit to any 1Password domain that entire day.
So we know an owner-level action caused this, and we cannot determine
which account or device it came from. Google's mail activity log keeps
only ten entries and had already rolled past the relevant window by the
time we looked.
We have an open ticket (750098) but have had only an automated reply.
The specific thing we need: the server-side record of which owner
account initiated the deletion request, and the originating IP. That
only exists on your side.
Also asking directly — is there any recovery path for a deleted
Business account? The confirmation email says deleted accounts cannot
be restored. I'd like that confirmed or denied clearly, so we know
whether to keep pursuing recovery or move fully to rotating every
credential we lost.
Happy to provide the account UUID privately. Any advice on escalating
this is appreciated.
Thank you!