{ "type": "bundle", "id": "bundle--0c399e83-90d7-5d4b-8886-b4bd438082eb", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--8582fb96-90e9-5a81-8ff1-76245a2303ce", "created": "2026-10-07T09:27:34Z", "modified": "2026-10-07T09:27:34Z", "x_ally_original_id": "org:96eeedac-7469-41f0-8aaf-b2410e4a54a2", "name": "Zeabur Inc.", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--3596db78-42fd-5ef1-8599-0e7b07b7ecc5", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "inc:42dc0fc6-a3a7-4dd6-8871-17e6f990d7bb", "name": "Zeabur October cloud-credential compromise" }, { "type": "incident", "spec_version": "2.1", "id": "incident--46de8d13-d901-5c34-87d5-96dec01918d1", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "brh:c2705eca-d5c9-456d-a3b8-da8b1f7de96c", "name": "Zeabur October cloud-credential compromise" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--26ff2ea6-1e1e-55f0-84fd-9aaf77283cf8", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:504a2454-fdb5-4d4f-9dbb-2d8a97a01bb7", "relationship_type": "resulted-in", "source_ref": "incident--3596db78-42fd-5ef1-8599-0e7b07b7ecc5", "target_ref": "x-ally-event--3306c0bf-fe1e-5702-8579-b745deeb4401", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:d5ed5f32-3431-4903-a950-26ef60d74814", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f352244-a336-5c9b-852e-1f8c91509be2", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:f4a8ca6a-a7f9-48e9-90cd-ed34c6730b98", "relationship_type": "resulted-in", "source_ref": "incident--3596db78-42fd-5ef1-8599-0e7b07b7ecc5", "target_ref": "x-ally-event--c57647d6-023a-5666-8b8b-8171cb8ff13b", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:f70217c6-c148-452d-9bf8-fa7236208197", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58580094-cfb5-5c0d-88a8-bd640327a485", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:a166f74e-32ff-42b1-b6dd-42ee18f03f39", "relationship_type": "affected-organization", "source_ref": "incident--3596db78-42fd-5ef1-8599-0e7b07b7ecc5", "target_ref": "identity--8582fb96-90e9-5a81-8ff1-76245a2303ce", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:6922aa40-00f3-43cc-a82d-cdedc2c173ba", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bbee76a9-34b3-583b-84a1-d8b8bf40a905", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:be690663-2fc1-4f50-a4ac-1906134da4bc", "relationship_type": "resulted-in", "source_ref": "incident--3596db78-42fd-5ef1-8599-0e7b07b7ecc5", "target_ref": "x-ally-event--c6fe70a3-0865-5bfa-8785-8610942d5ddb", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/zeabur-is-shutting-down", "external_id": "cit:f792de17-dd3f-4ba8-ac03-b45746014585", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a2af3c86c42aed5c0bc63d07d01452155a9920dad1ab93b60b01125c9108be8f" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f0133910-3e32-50a8-8136-18ce11b7421c", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:f9496da7-9559-414b-966d-2201b6c84c1c", "relationship_type": "resulted-in", "source_ref": "incident--3596db78-42fd-5ef1-8599-0e7b07b7ecc5", "target_ref": "x-ally-event--ef3ca653-73f3-5e74-8cad-d7478167ac69", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:11a68e66-ad34-481c-bbf2-8e46f7419729", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--27930c00-5235-5b1f-8e48-af441a915b80", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:c93a23f0-911d-4ee6-9337-ef40d88a8eaa", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:5a5f0c27-9b55-4a26-b5a7-a316086f8eea", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Zeabur confirmed root sign-ins to 101 GCP dedicated servers serving 92 users; this establishes server access, not that all server contents were copied." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--321ab471-c8cb-50e5-8681-d83e1bc366d5", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:cb6a5ef9-cb5b-4f89-9b25-fadecef86cb3", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:6f02f6c6-79ac-4f35-9277-473c90cf26fe", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-14" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--3c679afa-3310-5543-8a83-bac0e95320cc", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:b5a7e124-6c92-45af-959c-6ca649fceb6c", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/zeabur-is-shutting-down", "external_id": "cit:5cd11f1a-4baf-4d5f-8496-63da5f9fd7cb", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a2af3c86c42aed5c0bc63d07d01452155a9920dad1ab93b60b01125c9108be8f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Zeabur stopped accepting new dedicated-server and domain purchases and offered account-balance refunds; incident-loss compensation requests were a separate process." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--41c13af0-5514-51a1-8e36-50599fcaa1bb", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:1e5f552d-49e5-43bb-a61f-84ee0b2b90cb", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:fc4578e4-f92f-4370-9a66-0de7f631122a", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Zeabur confirmed reads of 321,810 account records and 3,218,965 service environment-variable records in its platform database. These are separate record populations, not a combined affected-person count." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--6898234e-e04e-5832-824f-7cee232f2f91", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:8610490e-64d9-48df-8e64-1edbe78bb733", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:dd5637eb-e9c5-4b91-8997-6a6e7a32c117", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-15" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--696d651d-5cba-5b71-82e2-23fc4bde66a0", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:7b71573e-a38f-4c29-997e-c4617016fb40", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/zeabur-is-shutting-down", "external_id": "cit:b60357e1-31f2-40d6-ad7f-1be6f01ad4f7", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a2af3c86c42aed5c0bc63d07d01452155a9920dad1ab93b60b01125c9108be8f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-17" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--747f9661-36a1-5008-8c45-89183f86cd91", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:0bf6709a-ede0-4030-8992-1c76605920bf", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/zeabur-is-shutting-down", "external_id": "cit:ef37a2f1-3ac7-4da8-93eb-3e146b56aceb", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a2af3c86c42aed5c0bc63d07d01452155a9920dad1ab93b60b01125c9108be8f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "In its October 17 announcement, Zeabur said it would wind down: shutdowns start December 1 and all dedicated servers and shared clusters are scheduled to stop by December 31, 2026." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--7917b08f-6aec-573f-813c-0fc35f7c5708", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:603225cd-395d-4589-866e-06770f8d5648", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:515a2186-3271-4ff9-a489-aa13ccd14542", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-14" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--9e0b5cc7-f61b-560e-82f4-8660763289d6", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:ad640587-98c4-40f0-96e0-7e2d60615773", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:27971da8-f6b9-47b7-b780-0923ea9c3232", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Zeabur revoked keys and tokens, removed the attacker’s network node, blocked public management access and urged users to replace credentials even if replaced after August." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--a79b1ee4-2a9d-5b11-84ef-5dc137023fbb", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:8d306d01-95ac-4e60-88ae-a5cfecc4d0d9", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:49e04d9c-3a43-47c2-8736-6df1961e5c76", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Shared-cluster exposure covered nine regions, with incomplete logs; database contents across 865 database services were assessed exposed rather than uniformly confirmed read." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--c11eed03-696e-52b9-8e8b-41076f353e95", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:695b0d76-95d2-4a9e-8a39-2f1f4a14c66d", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:1e1cf87f-5540-486a-98a6-67f88f63a907", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The attacker used internal-network credentials to add a node and read the production database on October 15 between 16:10 and 16:47 UTC." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--c3bf755a-e61b-5502-8dea-e7c96b32fcff", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:6901c9b5-d14e-435d-9c0b-bd57922e4c8e", "confidence": 100, "external_references": [], "x_ally_claim_object": { "kind": "iri", "value": "https://attack.mitre.org/techniques/T1078/004/" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--df95c018-ff5d-5c17-8ed1-baf9e2923314", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:9ef943cf-dd74-4e3b-a222-bfbbd05cb303", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:789a330d-3201-40bd-afc3-73c877cab89d", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The theory that the credentials came from a GitHub App key leaked in August remained unconfirmed; Zeabur had requested additional GitHub records." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--df96e949-ad98-5280-809c-90eb6c19de70", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:2ea2c3b7-6002-443e-92c1-911c5d1867f0", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:1d86b490-1dcf-4736-992a-e0cd08d98e3a", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Zeabur said long-lived plaintext admin credentials and internet-accessible management interfaces were root causes. The August rotation did not cover credentials used in October." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--e01b231c-ce84-5b98-8a48-18fec62d09d2", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:e33fe653-999f-4aa5-9fbf-a8f16ade366b", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:15326c00-c4b8-4946-8899-74941d350864", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-19" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--e8afe9a0-aee5-523b-8c2f-5bfe8024617d", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:187c804b-c553-4659-9799-c794ee673e53", "confidence": 100, "external_references": [ { "source_name": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "external_id": "cit:7257aab7-c78d-4757-a3bf-c0513a408093", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:f78aeb08ab62805b245ae084ef335f900e248a4d32d6dfee6ee878ec96f15d38" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Zeabur said attackers used leaked internal AWS keys and cluster admin tokens on October 14 to reach shared infrastructure; separate GCP credentials enabled access to dedicated servers." } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--3306c0bf-fe1e-5702-8579-b745deeb4401", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "evt:218bd1ae-c41d-4048-95e3-f4f6a5f643c2", "name": "Cloud credentials and servers accessed" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--c57647d6-023a-5666-8b8b-8171cb8ff13b", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "evt:487f431d-c9fb-453f-a3c8-e571c185aca9", "name": "Preliminary incident report published" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--c6fe70a3-0865-5bfa-8785-8610942d5ddb", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "evt:f55e5413-5900-4f85-8b39-18992e2bd2c8", "name": "Wind-down announced" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--ef3ca653-73f3-5e74-8cad-d7478167ac69", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "evt:cfb68c6b-2132-4e0d-bc3a-56ba83537c40", "name": "Platform database read" } ] }