2026 Chainstack — attacker entered through a third-party component and reached production; customer account data and hashed passwords exposed
Data compromised
A production database holding customer account data: organization names, account holder names, member email addresses and hashed passwords. The attacker also reached systems that hold node credentials. Chainstack says there is no evidence they were read but is treating them as exposed. No record counts have been published.
Technical writeup
Chainstack asks customers to rotate node credentials, regenerate platform API keys and change passwords, including on other services where the same password was used. It also warns customers to watch for phishing. The disclosure does not describe direct notifications beyond the public statement.
Root cause
The attacker got in through a third-party component and first reached a development environment on October 26, 2026, then moved into parts of production. Chainstack detected the intrusion on October 31 and cut the attacker's access the same day. The company calls the intruder an "external attacker" and has not named an actor. The link to an AI-driven campaign and to ARTEX is The Hacker News's assessment, not Chainstack's.