Zeabur Discloses Second Breach in Two Months, Compromising 321,810 Accounts
Attackers used leaked plaintext credentials to access Zeabur’s infrastructure, stealing millions of environment variable records and exposing sensitive account data.
Key points
- Zeabur suffered a second security incident in October 2026, affecting 321,810 user accounts.
- Attackers accessed production databases and stole over 3.2 million environment variable records.
- The breach involved compromised administrator credentials that had not been rotated since January 2024.
Development platform Zeabur disclosed a significant cybersecurity incident on October 14 and 15, 2026, in which attackers compromised its internal infrastructure using leaked credentials. According to the company’s announcement, the breach resulted in the theft of data from 321,810 accounts and the exfiltration of more than 3.2 million environment variable records.
The attackers gained entry to Zeabur’s shared hosting clusters and dedicated servers by using stolen administrator credentials and cloud access keys. They subsequently accessed the platform’s production database. Zeabur stated that the credentials used in this attack were likely obtained during a previous security incident in August 2026, although the company has not officially confirmed that connection.
Infrastructure Compromise Details
The scope of the October breach was extensive, impacting shared clusters across nine different regions. Zeabur confirmed that attackers performed root sign-ins on 101 Google Cloud Platform (GCP) servers using 92 different user accounts. The malicious actors added SSH keys to 50 of these servers and attached 16 copies of customer disks to their own virtual machines for further access.
Zeabur identified critical internal failures that facilitated the breach. Administrator tokens had no expiration dates and had not been rotated since their creation in January 2024. Additionally, these tokens were excluded from credential rotation efforts following the August incident. The company also noted that administrator portals remained accessible via the public internet, and internal credentials were stored in plaintext rather than in an encrypted format.
Affected Users and Data
This incident marks the second major security breach for Zeabur in just two months. In late August 2026, hackers exploited a vulnerability in a customer’s NextChat application and moved laterally through poorly isolated internal systems. That earlier attack led to the theft of AWS credentials and access to the production database, exposing account information, API keys, and other secrets.
The latest incident affected a broader range of infrastructure, including shared clusters and dedicated servers. The stolen environment variable records contain sensitive configuration data that users often store in such platforms. Zeabur advised all users to assume their credentials and secrets are exposed. The company urged immediate rotation of exposed credentials, revocation of all active sessions, and the rebuilding of any compromised GCP servers to ensure security.
What should you do?
Zeabur has urged users to take immediate action to secure their accounts following the disclosure of the breach.
What to do and how to stay safe: Zeabur
- Rotate all environment variables, API keys, and secrets stored in Zeabur immediately, as the platform confirms these records were stolen.
- Revoke all active user sessions and administrator tokens associated with your Zeabur account to prevent unauthorized access.
- Rebuild any Google Cloud Platform (GCP) servers that were potentially compromised, as attackers attached customer disk copies to their own virtual machines.
- Audit your internal systems for any dependencies on Zeabur-hosted services and verify that no new SSH keys or unauthorized users have been added.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many accounts were affected by the Zeabur breach?
The breach impacted 321,810 accounts and resulted in the theft of over 3.2 million environment variable records.
Did Zeabur confirm the October breach was linked to the August incident?
Zeabur stated that attackers likely obtained the credentials used in the October attack during the August breach, but the company has not confirmed this definitively.
What caused the October breach?
Attackers used leaked internal credentials stored in plaintext, which had not been rotated since January 2024, to access Zeabur’s infrastructure and production database.
