Unauthorized Access to Zeabur Infrastructure and User Data
Last updateresolvedOct 20 · 02:09 UTC
We have published our preliminary report on the October 2026 Zeabur security incident. It details the attack paths identified so far, the scope of impact, the causes, and the remediation measures we have completed. The investigation is ongoing, and the report will be updated as new evidence becomes available. The attacker used compromised internal credentials to access our shared clusters and some GCP dedicated servers, then read environment variables, account information, and project data from the platform database. We have revoked the relevant credentials, blocked known entry points, and adjusted access controls and backup practices. Exposed data may still be misused. Please follow the report’s guidance to replace affected passwords and keys, even if you already replaced them after the August incident. We are responsible for failing to fully implement credential rotation and security improvements. We sincerely apologize to all affected users. If this incident resulted in additional charges from third-party services, please submit a compensation request through a support ticket. We will review the relevant records and explain our findings. We will be transparent about both the confirmed facts and the questions that remain unresolved. Incident report: https://zeabur.com/blogs/october-2026-security-incident
Reported by Zeabur on their status page.