2026 Zeabur — shared clusters and platform database breached; 321,810 accounts and 3.2M environment-variable records
Data compromised
Platform database: 321,810 accounts (email, username, phone number, profile data), 3,218,965 environment-variable records (names and values), 566 plaintext zSend API keys and 11,536 hashed access tokens (all revoked). Shared clusters in 9 regions: secrets of all services; commands run in 865 database services (736 n8n). Root sign-ins on 101 GCP Dedicated Servers, SSH keys added to 50, 16 customer disk copies attached to attacker VMs.
Technical writeup
Verified Zeabur preliminary report (Oct 19, 2026). Oct 14 01:36 UTC the attacker used a Zeabur AWS key, then a never-expiring shared-cluster admin token (created Jan 2024, written in plaintext to a config repo Jan 2026) against a publicly reachable admin interface, reading settings and secrets of every service on the shared cluster across 9 regions. A second path used plaintext root passwords to sign in to 101 GCP Dedicated Servers. Credentials from a compromised server let the attacker join the internal network on Oct 15 and read the platform database. Investigation began Oct 15 after a user report; last attacker activity Oct 15 21:05 UTC. Second breach in two months (see zeabur-nextchat2026); Zeabur is winding down, pausing shared clusters Dec 1 and shutting down Dec 31, 2026. companyConfirmed true; recordsAffected = 321,810 accounts.
Root cause
Non-expiring shared-cluster admin token and AWS key stored in plaintext in a configuration repository, missed by the August 2026 credential rotation; admin interface reachable from the internet; root passwords for GCP Dedicated Servers kept in plaintext initialization settings.