Artificial Intelligence
Chainstack discloses breach exposing customer data and hashes
Chainstack said an intruder reached part of its infrastructure through a third-party component, accessed customer account data and password hashes, and may also have exposed node credentials.
- Chainstack said an external attacker reached part of its infrastructure through a third-party component.
- The company said the intruder reached a development environment on 26 October 2026 and later moved into some production systems.
- Chainstack said the intrusion was found on 31 October 2026 and access was blocked that day.
- The company said a database with customer account details and password hashes was accessed, and node credentials were treated as exposed.
- The article said the incident was assessed as part of a wider campaign associated with ARTEX.
Chainstack said an external attacker got into part of its infrastructure through a third-party component. The company said it detected the intrusion, cut off access paths and was hardening its systems.
According to Chainstack’s timeline, the attacker entered a development environment on 26 October 2026 and then moved further into some production systems. The company said it found the intrusion on 31 October 2026 and stopped access that day.
Chainstack said the attacker accessed a database containing organisation names, account-holder names, member email addresses and password hashes. It also said systems containing node credentials were accessed, though it had no evidence that they were read.
The company advised customers to rotate node credentials, regenerate platform API keys and change passwords, including reused passwords. It also told them to watch for phishing attempts.
The article said the incident was believed to overlap with a campaign linked to a China-associated group using ARTEX. It also said WorkOS, Chainalysis and the Dutch Institute for Vulnerability Disclosure had each disclosed separate incidents connected to the same framework or related techniques.
Named in this story
Companies
- Chainstack
- disclosed the breach and the affected systems
- WorkOS
- disclosed a separate incident involving its GTM systems
- Chainalysis
- said it had detected external access and took products offline
Organisations
- Dutch Institute for Vulnerability Disclosure
- was described as another organisation hit by the campaign
Products and systems
- ARTEX
- was identified as the framework used in the incidents
- Zammad
- was the ticketing system whose flaws were exploited
- Reactor
- was one of Chainalysis’s products taken offline
- Data Solutions
- was one of Chainalysis’s products taken offline
How the source tells it
The article was mostly straight incident reporting, with some threat framing around AI-powered attacks and a broader trend line.
- threat framing the breach was linked to a larger AI-powered campaign without incident-specific technical detail
- urgency customers were told to rotate credentials and watch for phishing after the disclosure