Zeabur to Shut Down After Second Breach Exposes 3.2 Million Environment Records

Summary

Zeabur says attackers used leaked internal credentials to access its infrastructure and steal data from 321,810 accounts and over 3.2 million environment-variable records. The company plans to shut down services by December 31, 2026.

Key points

• Zeabur said attackers used leaked internal credentials, administrator credentials, and cloud access keys to access shared clusters, dedicated servers, internal systems, and its production database on October 14–15, 2026.
• The company reported exposure of information for 321,810 accounts and roughly 3.2 million environment-variable records across shared clusters in nine regions.
• Zeabur confirmed root sign-ins on 101 GCP servers by 92 users; attackers added SSH keys to 50 servers and attached 16 customer disk copies to their own virtual machines.
• Zeabur said the credentials were likely obtained during an August breach, but it has not confirmed this. It also said administrator credentials were not fully rotated after that incident and admin portals remained publicly accessible.
• Zeabur urged users to rotate exposed credentials and secrets, revoke active sessions, and rebuild compromised GCP servers.
• Zeabur plans to disable renewals and pause shared-cluster services on December 1, 2026, then stop all dedicated servers and shared clusters by December 31; migration timelines remain unspecified.

MITRE ATT&CK

Products

Related Articles

• TeamUpdraft Breach Leads to Backdoor Attempts on Connected WordPress SitesT1078 · T1098
• Kaspersky 2026 Report Highlights Exploited Applications, Trusted Access and SOC Detection GapsT1078 · T1098
• US, UK and Germany Warn SafePay Ransomware Has Hit at Least 600 VictimsT1078 · T1098
• BeyondTrust Patches Critical Remote Support Zero-Day Exploited by Suspected Espionage ActorT1078 · T1098
• Mandiant Details ARMORY CASTLE’s Exploitation of BeyondTrust Remote SupportT1078 · T1098