Zeabur to shut down after second breach exposes 321,810 accounts
Original title: Zeabur shutting down after second security breach in two months
Attackers used leaked plaintext internal credentials to read the production database and access shared clusters in nine regions.
Zeabur says an attacker used leaked internal credentials on October 14–15, 2026, to enter its shared cluster, some dedicated servers, and internal systems, then read the production database. The company reports about 3.2 million environment-variable records and information for 321,810 accounts were taken, plus root sign-ins on 101 GCP servers, SSH keys added to 50 servers, and 16 customer disk copies attached to attacker VMs. Zeabur says admin tokens created in January 2024 had no expiry and were not rotated after an August breach. It will stop shared-cluster services on December 1 and finish shutdown by December 31, 2026.
Unconfirmed: Zeabur says the second-attack credentials were likely taken in August but has not confirmed that.
- August 2026 breach began in a customer NextChat app and exposed AWS credentials and the production database.
- Admin portals stayed reachable from the public internet, and credentials were stored in plaintext.
- Users are told to rotate secrets, revoke sessions, and rebuild compromised GCP servers.
- Variables already moved only to customers’ own servers were not in this database exposure.
- Renewals end December 1; dedicated servers and shared clusters stop by year-end.
Impact: Theft of account data and about 3.2 million environment-variable records
| Product | Affected |
|---|---|
| Zeabur hosting platform | — |
- 1.Rotate exposed credentials and secrets immediately and revoke all active sessions.
- 2.Rebuild compromised GCP servers.
From the original article
3 min read at bleepingcomputer.com
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3. 2 million environment variable records and information for 321,810 accounts. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.