Chainstack Says Attackers Accessed Customer Data and Password Hashes
Summary
Chainstack says an attacker used a third-party component to access development and production systems, including a database with customer information and password hashes. The company detected and cut off access, and advises customers to rotate credentials and API keys.
Key points
- Chainstack says an external attacker accessed its development environment on October 26, 2026, then reached parts of its production environment.
- The company detected the intrusion and cut off the attacker’s access on October 31.
- A database accessed by the attacker contained organization and account-holder names, member email addresses, and password hashes.
- Systems holding node credentials were accessible, but Chainstack says it has no evidence the credentials were read and is treating them as exposed.
- Chainstack advises customers to rotate node credentials, regenerate platform API keys, update reused passwords, and watch for phishing.
- The attack is assessed to share overlaps with an AI-powered campaign associated with a China-linked cluster using ARTEX; Chainstack did not disclose attack specifics.
Article Details
- Victim Organization
- Chainstack
- Incident Type
- Unauthorized access to Chainstack infrastructure through a third-party component; the incident was assessed to overlap with an AI-powered campaign reportedly involving an unnamed China-linked cluster using ARTEX.
- Incident Date
- 2026-10-26
- Data Types Exposed
- Organization names
- Account holder names
- Email addresses of organization members
- Password hashes
- Node credentials (systems holding them were accessed; Chainstack said it had no evidence they were read and treated them as exposed)
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- The intrusion was detected and access was cut off on 2026-10-31. Chainstack said it was hardening its systems and advised customers to rotate node credentials, regenerate API keys, update passwords, and watch for phishing. No production outage or other operational disruption was reported.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
CVE
CVE-2026-102489Zammad GmbH · Zammadbreach involved the exploitation of two zero-day flaws in the open-source Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490), enabling attackers to escalate privileges, run code remotely, and exfiltrateCVE-2026-102490Zammad GmbH · Zammadexploitation of two zero-day flaws in the open-source Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490), enabling attackers to escalate privileges, run code remotely, and exfiltrate data.
Products
Data Solutionssystems and internal tools. As of November 2, 2026, the company has proactively taken its Reactor and Data Solutions products offline.Reactoraccess to its systems and internal tools. As of November 2, 2026, the company has proactively taken its Reactor and Data Solutions products offline.Zammad(DIVD). The September 21, 2026, breach involved the exploitation of two zero-day flaws in the open-source Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490), enabling attackers to escalate privileges, run