Summary
- Environment: Zeabur shared clusters, dedicated servers and platform database
- Operational impact: Customer credentials exposed; platform wind-down scheduled
- Financial impact: No total incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 21, 2026; updated as evidence emerges.
What happened
Zeabur confirmed an October 14–15, 2026 intrusion involving cloud credentials, customer servers and its platform database. This is separate from its August incident. [1]
Impact
Zeabur confirmed reads of 321,810 account records and 3,218,965 environment-variable records. It also confirmed access to 101 GCP servers serving 92 users. These measures are not interchangeable affected-person totals. [1]
On October 17, Zeabur announced a wind-down: shutdowns begin December 1, with all dedicated servers and shared clusters scheduled to stop by December 31. Those dates are future plans. [2]
Timeline
Cloud systems accessed
Attackers used internal credentials.
[1]Platform database read
Database access occurred between 16:10 and 16:47 UTC.
[1]Wind-down announced
The shutdown announcement set a December transition.
[2]Briefing updated
This briefing was last reviewed and updated on October 21, 2026.
Threat Group & Attack Vector
Long-lived plaintext credentials and exposed management interfaces enabled access. Whether the credentials originated in August remains a hypothesis. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078.004 — Cloud Accounts: stolen cloud credentials enabled access. [1]