An attacker used leaked internal credentials to steal over 3.2 million environment-variable records and information for 321,810 accounts, a breach that prompted Zeabur to announce it will shut down services at the end of 2026.
Scope of the compromise: shared clusters across nine regions, 101 GCP servers, and attached customer disks
Zeabur says the October 14–15, 2026 incident reached across its platform: shared clusters in nine regions were affected, roughly 3.2 million environment-variable records and the records for 321,810 accounts were read from the platform database, and root sign-ins occurred on 101 Google Cloud Platform (GCP) servers by 92 users. The attackers added SSH keys to 50 servers and attached 16 customer disk copies to their own virtual machines, according to the company’s disclosure. Zeabur says attackers used stolen administrator credentials and cloud access keys to move from shared hosting infrastructure and dedicated servers into production systems.
Attack chain and links to the August breach
The October activity followed an earlier incident in late August 2026 in which attackers exploited a flaw in a customer’s NextChat application and then "moved through poorly isolated internal systems," stealing AWS credentials and gaining access to the production database. That August breach exposed account information, API keys, and other secrets stored there. Zeabur says the credentials used in the October attack were likely obtained during the August breach, though the company has not confirmed that linkage.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOperational failures: plaintext credentials, long-lived admin tokens, and public admin portals
In its post-incident account Zeabur acknowledged a series of operational mistakes that amplified the damage. The company said internal credentials were stored in plaintext and that not all administrator account credentials were rotated after the August incident. Administrator portals remained reachable from the public internet. As Zeabur put it, "The admin tokens had no expiry, had not been rotated since they were created in January 2024, and were not included in the post-August rotation."
Variables that had been migrated exclusively to customers' own servers during the August response escaped the latest platform database exposure, Zeabur says, but the company warned that compromised hosts could still expose those values.
Zeabur's shutdown decision and timeline
Facing "increasingly complex" scale and the recent security failures, Zeabur announced over a weekend that it will wind down operations. The company said that on December 1, 2026, renewals will be disabled and all running services on shared clusters will be paused. By December 31, 2026, all dedicated servers will expire and shut down and all shared clusters will stop. Zeabur described a period of internal deliberation after the August incident—"After the August incident, we spent a long time discussing and struggling with what to do next"—and said the October breach prompted a reassessment of what the team could responsibly carry: "Following this latest incident, we reassessed what it would take to keep operating and the responsibilities our team could carry. We ultimately decided to wind down."
The company said users might be given additional time to migrate data but has not provided concrete timelines for extended access or migration windows.
What this means for developers, enterprise customers, and security teams
- Developers and end users: Zeabur urged immediate action—rotate any exposed credentials and secrets, revoke all active sessions, and rebuild compromised GCP servers. Environment variables, API keys, and account information in the production database are specifically flagged as exposed.
- Enterprise customers and administrators: Variables moved to customer-controlled servers during the August response were not located in the platform database exposure, but Zeabur notes compromised hosts could still put those values at risk. Customers face a concrete migration and secrets-rotation challenge against a December closure timeline.
- Security teams and defenders: Zeabur’s disclosure underscores the risk posed by valid credentials. As the company and a related industry metric note, "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026—cited in the disclosure—measures defenses technique by technique across mass simulations, a reminder that credential hygiene and rapid rotation are central to limiting post-access damage.
Zeabur’s announcement ties a serious data exposure to operational choices: plaintext secrets, long-lived admin tokens, and incomplete post-incident rotation. It leaves concrete questions for customers—how much time will be available for migrations, which accounts and keys must be rotated, and whether forensic work will confirm the August–October credential linkage. For now, the company has set a firm shutdown window and advised immediate remediation actions for affected accounts.
