Blocked attachments outside an active issue

When Material remediates a malicious email, it replaces the original attachment with a stub — a placeholder that alerts recipients the content has been secured. In most cases, this happens within an active issue that admins can find and act on in Issue Details.

Occasionally, a recipient reports an inaccessible attachment in a message that has no visible issue attached to that message. The original message in the thread may still belong to a parent issue. This page explains the most common causes and how to resolve them.

---

Why this happens

The message is part of a thread where the original was remediated

When Material remediates a malicious email, it replaces the original attachment with a stub. If that email later becomes part of a thread — for example, a colleague replies to or forwards the original message internally — the stub travels with it. Recipients of those later messages inherit the blocked attachment even though their message was never independently flagged and will not appear in an active issue.

This is the most common cause of blocked attachments outside an issue.

The attachment hash matched a previously flagged file

Material uses attachment hash matching to identify files that have appeared in known malicious messages. If an attachment's hash matches one from a previously flagged issue, Material may block it in subsequent messages — even ones from senders who are not under any active issue.

Trusted entity status does not override attachment hash blocking. A message from a trusted domain can still have its attachment blocked if the attachment's hash matches a previously flagged file.

If you believe this is the cause, contact Material Support. Hash-level overrides require escalation and are not available in the admin UI.

---

How to investigate and release

1. Find the affected message in Message Explorer

   1. Open Message Explorer. Search by recipient, subject, or message ID.

   2. Open the message and review the full thread. Look for the earliest message in the thread. That message is usually the one tied to the parent issue.

      
   3. If you know the attachment hash, search for message.attachments.hash to find every message that contains that file.

2. Open the parent issue

   1. From the original message, open the linked parent issue.

   2. Review the issue context in Issue Details and inspect the message history in Detected and similar messages. The internal recipient's copied or forwarded message may not appear in the issue. That is expected. The parent issue tracks the original flagged message, not every downstream thread copy.

3. Classify and restore if the file is safe

   If the parent issue is a false positive, or if you confirm the attachment is safe, update the issue in Response and Remediation. Set the classification to Safe and the response to Restore. This restores the original attachment for affected recipients.

   Only admins with access to the parent issue can take this action. The recipient of the copied or forwarded message will not see the issue on their end.

---

If no parent issue exists

If you've traced the thread and cannot find a parent issue — for example, the block appears to be a pure hash match with no related active issue — contact Material Support with the affected message ID.

To get the message ID:

1. Find the message in Message Explorer or from within an issue.

2. Click the message row to open Message Details.

3. Click All Actions (or ⌘K) → Copy Message ID.

   

   Copy the message ID from Message Details.

Share the message ID with Support so they can investigate the hash match and apply an override if appropriate. For support access details, see Support Settings.