--- title: "Zeabur October cloud-credential compromise" description: "Zeabur reported an October intrusion into cloud systems and its platform database, then announced a December shutdown." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-21" canonical_url: "https://www.ally.security/incidents/zeabur-october-cloud-credential-compromise-2026" markdown_url: "https://www.ally.security/incidents/zeabur-october-cloud-credential-compromise-2026.md" stix_url: "https://www.ally.security/incidents/zeabur-october-cloud-credential-compromise-2026/stix.json" --- # Zeabur October cloud-credential compromise Leaked internal credentials exposed account information and service environment variables. Last modified Oct 21, 2026 · 2 sources ## Summary - **Environment:** Zeabur shared clusters, dedicated servers and platform database - **Operational impact:** Customer credentials exposed; platform wind-down scheduled - **Financial impact:** No total incident cost established in the reviewed evidence ## What happened [Zeabur](https://zeabur.com/) confirmed an October 14–15, 2026 intrusion involving cloud credentials, customer servers and its platform database. This is separate from its [August incident](/incidents/zeabur-production-database-credential-incident-2026). [1](#source-1) ## Impact Zeabur confirmed reads of 321,810 account records and 3,218,965 environment-variable records. It also confirmed access to 101 GCP servers serving 92 users. These measures are not interchangeable affected-person totals. [1](#source-1) On October 17, Zeabur announced a wind-down: shutdowns begin December 1, with all dedicated servers and shared clusters scheduled to stop by December 31. Those dates are future plans. [2](#source-2) ## Timeline ### October 14, 2026 — Cloud systems accessed Attackers used internal credentials. [1](#source-1) ### October 15, 2026 — Platform database read Database access occurred between 16:10 and 16:47 UTC. [1](#source-1) ### October 17, 2026 — Wind-down announced The [shutdown announcement](https://zeabur.com/blogs/zeabur-is-shutting-down) set a December transition. [2](#source-2) ### October 19, 2026 — Preliminary report published The [report](https://zeabur.com/blogs/october-2026-security-incident) separated confirmed access from assessments. [1](#source-1) ### October 21, 2026 — Briefing updated This briefing was last reviewed and updated on October 21, 2026. ## Threat Group & Attack Vector Long-lived plaintext credentials and exposed management interfaces enabled access. Whether the credentials originated in August remains a hypothesis. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1078.004 — Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/): stolen cloud credentials enabled access. [1](#source-1) ## Response Zeabur revoked keys and tokens, removed the attacker’s network node and blocked public management access. Users were urged to replace credentials again. [1](#source-1) Account-balance refunds and incident-loss compensation are separate requests. Zeabur stopped new dedicated-server and domain purchases. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Zeabur October 2026 security incident (preliminary report) official · Zeabur · Oct 19, 2026 ### Zeabur is shutting down: what happens next official · Zeabur · Oct 17, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: In its October 17 announcement, Zeabur said it would wind down: shutdowns start December 1 and all dedicated servers and shared clusters are scheduled to stop by December 31, 2026. 2. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Zeabur said attackers used leaked internal AWS keys and cluster admin tokens on October 14 to reach shared infrastructure; separate GCP credentials enabled access to dedicated servers. 3. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Zeabur confirmed reads of 321,810 account records and 3,218,965 service environment-variable records in its platform database. These are separate record populations, not a combined affected-person count. 4. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Zeabur said long-lived plaintext admin credentials and internet-accessible management interfaces were root causes. The August rotation did not cover credentials used in October. 5. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Cloud credentials and servers accessed 6. **Occurred At · 100% confidence · current** Cloud credentials and servers accessed: 2026-10-14 7. **Used Attack Technique · 100% confidence · current** Zeabur October cloud-credential compromise: https://attack.mitre.org/techniques/T1078/004/ 8. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: The attacker used internal-network credentials to add a node and read the production database on October 15 between 16:10 and 16:47 UTC. 9. **Occurred At · 100% confidence · current** Wind-down announced: 2026-10-17 10. **Occurred At · 100% confidence · current** Platform database read: 2026-10-15 11. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Shared-cluster exposure covered nine regions, with incomplete logs; database contents across 865 database services were assessed exposed rather than uniformly confirmed read. 12. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: The theory that the credentials came from a GitHub App key leaked in August remained unconfirmed; Zeabur had requested additional GitHub records. 13. **Affected Organization · 100% confidence · current** Zeabur October cloud-credential compromise: Zeabur Inc. 14. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Zeabur revoked keys and tokens, removed the attacker’s network node, blocked public management access and urged users to replace credentials even if replaced after August. 15. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Zeabur stopped accepting new dedicated-server and domain purchases and offered account-balance refunds; incident-loss compensation requests were a separate process. 16. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Wind-down announced 17. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Zeabur confirmed root sign-ins to 101 GCP dedicated servers serving 92 users; this establishes server access, not that all server contents were copied. 18. **Began At · 100% confidence · current** Zeabur October cloud-credential compromise: 2026-10-14 19. **Occurred At · 100% confidence · current** Preliminary incident report published: 2026-10-19 20. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Preliminary incident report published 21. **Resulted In · 100% confidence · current** Zeabur October cloud-credential compromise: Platform database read