Zeabur to shut down after latest breach

Zeabur said an attacker used leaked internal credentials to get into its shared cluster, some dedicated servers and internal systems on 14–15 October 2026. The company said the intruder then accessed the platform database and took data linked to 321,810 accounts and about 3.2 million environment-variable records.

Zeabur said it also saw root log-ins on 101 GCP servers by 92 users, while SSH keys were added to 50 servers and 16 customer disk copies were attached to attacker-controlled virtual machines. The company said the credentials used in the second incident were probably obtained during the August breach, but it had not confirmed that.

In the August incident, Zeabur said attackers began with a flaw in a customer’s NextChat application and then moved through internal systems that were not well isolated. That earlier incident led to the theft of AWS credentials and access to the production database, according to the company.

Zeabur said it had failed to keep all administrator credentials encrypted and had not rotated all of them after the August incident. It said its administrator portals were still reachable from the public internet, and that the admin tokens had no expiry and had not been rotated since January 2024.

After the latest breach, Zeabur said it would stop taking renewals on 1 December 2026, pause services on shared clusters that day and close all remaining services by 31 December 2026. The company said some users might get extra time to move data, but it gave no dates for that process.