---
title: "Chainstack account and node-credential incident"
description: "Chainstack reported an intrusion that reached development infrastructure on October 26, 2026, and parts of production on October 29."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/chainstack-account-and-node-credential-incident-2026"
markdown_url: "https://www.ally.security/incidents/chainstack-account-and-node-credential-incident-2026.md"
stix_url: "https://www.ally.security/incidents/chainstack-account-and-node-credential-incident-2026/stix.json"
---

# Chainstack account and node-credential incident

Chainstack reported an intrusion that reached development infrastructure on October 26, 2026, and parts of production on October 29.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** Development, production and blockchain-node credential systems
- **Operational impact:** Account database accessed; node credentials treated as exposed
- **Financial impact:** No incident cost disclosed

## What happened

[Chainstack](https://chainstack.com/) reported an intrusion that reached development infrastructure on October 26, 2026, and parts of production on October 29. [1](#source-1)

## Impact

An accessed database held organization and account-holder names, member email addresses and password hashes. Node credentials were treated as exposed despite no evidence they were read. [1](#source-1)

Chainstack said customer services continued normally and nodes, the console and API were not modified. [1](#source-1)

## Timeline

### October 26, 2026 — Development environment accessed

Development environment accessed, according to the published account. [Incident notice](https://chainstack.com/security-incident-nov-2026/). [1](#source-1)

### October 29, 2026 — Production access begins

Production access begins, according to the published account. [Incident notice](https://chainstack.com/security-incident-nov-2026/). [1](#source-1)

### October 31, 2026 — Intrusion detected and access cut

Intrusion detected and access cut, according to the published account. [Incident notice](https://chainstack.com/security-incident-nov-2026/). [1](#source-1)

### November 2, 2026 — Investigation closed

Investigation closed, according to the published account. [Incident notice](https://chainstack.com/security-incident-nov-2026/). [1](#source-1)

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

The company identified a third-party component as the access path, without naming it or establishing a specific vulnerability. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Chainstack cut access on October 31 and closed its investigation on November 2. Customers were asked to change passwords, rotate node credentials and regenerate platform API keys. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/chainstack-account-and-node-credential-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Chainstack data security notice

official · Chainstack · Nov 3, 2026

<https://chainstack.com/security-incident-nov-2026/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Chainstack account and node-credential incident: Development environment accessed
2. **Resulted In · 100% confidence · current**  
   Chainstack account and node-credential incident: Chainstack cut access on October 31 and closed its investigation on November 2. Customers were asked to change passwords, rotate node credentials and regenerate platform API keys.
3. **Resulted In · 100% confidence · current**  
   Chainstack account and node-credential incident: Production access begins
4. **Occurred At · 100% confidence · current**  
   Production access begins: 2026-10-29
5. **Occurred At · 100% confidence · current**  
   Intrusion detected and access cut: 2026-10-31
6. **Discovered At · 100% confidence · current**  
   Chainstack account and node-credential incident: 2026-10-31
7. **Affected Organization · 100% confidence · current**  
   Chainstack account and node-credential incident: Chainstack
8. **Resulted In · 100% confidence · current**  
   Chainstack account and node-credential incident: Intrusion detected and access cut
9. **Resulted In · 100% confidence · current**  
   Chainstack account and node-credential incident: An accessed database held organization and account-holder names, member email addresses and password hashes. Node credentials were treated as exposed despite no evidence they were read.
10. **Occurred At · 100% confidence · current**  
   Development environment accessed: 2026-10-26
11. **Resulted In · 100% confidence · current**  
   Chainstack account and node-credential incident: Chainstack said customer services continued normally and nodes, the console and API were not modified.
12. **Occurred At · 100% confidence · current**  
   Investigation closed: 2026-11-02
13. **Resulted In · 100% confidence · current**  
   Chainstack account and node-credential incident: Chainstack reported an intrusion that reached development infrastructure on October 26, 2026, and parts of production on October 29.
14. **Resulted In · 100% confidence · current**  
   Chainstack account and node-credential incident: The company identified a third-party component as the access path, without naming it or establishing a specific vulnerability.
15. **Disclosed At · 100% confidence · current**  
   Chainstack account and node-credential incident: 2026-11-03
16. **Resulted In · 100% confidence · current**  
   Chainstack account and node-credential incident: Investigation closed

</details>