Zeabur Shuts Down After Massive Security Breach Exposes Millions of Records
Zeabur, a development platform provider, will cease operations by December 31, 2026, following a severe security breach that compromised millions of environment variables and user accounts. The attack, occurring between October 14 and 15, 2026, exploited leaked internal credentials stored in plaintext, granting attackers access to shared hosting infrastructure and dedicated servers.
The breach exposed 321,810 user accounts and 3.2 million environment variable records, with attackers gaining root access to 101 Google Cloud Platform servers. They added unauthorized SSH keys and attached customer disk copies to their own virtual machines. Investigations revealed that the credentials used in the attack likely stemmed from an earlier breach in August 2026, which Zeabur failed to mitigate by rotating administrator tokens some unchanged since January 2024. Additionally, administrative portals were left exposed to the public internet.
Citing the growing challenges of maintaining secure infrastructure, Zeabur announced its shutdown, urging users to rotate secrets, revoke active sessions, and rebuild compromised servers to limit further damage. The incident underscores the risks of unsecured credentials and inadequate security practices in cloud environments.
Source: https://www.scworld.com/brief/zeabur-to-shut-down-following-major-security-breach
Zeabur cybersecurity rating report: https://www.rankiteo.com/company/zeabur
"id": "ZEA1792622941",
"linkid": "zeabur",
"type": "Breach",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '321,810 user accounts',
'industry': 'Technology/Cloud Services',
'name': 'Zeabur',
'type': 'Development Platform Provider'}],
'attack_vector': 'Leaked internal credentials (plaintext)',
'customer_advisories': 'Public announcement of breach and shutdown, with '
'instructions for mitigation',
'data_breach': {'number_of_records_exposed': '3,521,810 (3.2M environment '
'variables + 321,810 user '
'accounts)',
'personally_identifiable_information': 'User account '
'credentials',
'sensitivity_of_data': 'High (plaintext credentials, PII, and '
'sensitive configuration data)',
'type_of_data_compromised': 'Environment variables, user '
'account credentials'},
'date_detected': '2026-10-14',
'description': 'Zeabur, a development platform provider, will cease '
'operations by December 31, 2026, following a severe security '
'breach that compromised millions of environment variables and '
'user accounts. The attack exploited leaked internal '
'credentials stored in plaintext, granting attackers access to '
'shared hosting infrastructure and dedicated servers. The '
'breach exposed 321,810 user accounts and 3.2 million '
'environment variable records, with attackers gaining root '
'access to 101 Google Cloud Platform servers.',
'impact': {'brand_reputation_impact': 'Severe (company ceasing operations)',
'data_compromised': '3.2 million environment variable records, '
'321,810 user accounts',
'identity_theft_risk': 'High (user accounts and environment '
'variables exposed)',
'operational_impact': 'Company shutdown by December 31, 2026',
'systems_affected': '101 Google Cloud Platform servers, shared '
'hosting infrastructure, dedicated servers'},
'initial_access_broker': {'backdoors_established': 'Unauthorized SSH keys '
'added to GCP servers',
'entry_point': 'Leaked internal credentials '
'(plaintext)',
'high_value_targets': 'Google Cloud Platform '
'servers, environment '
'variables'},
'investigation_status': 'Ongoing (as of shutdown announcement)',
'lessons_learned': 'Risks of unsecured credentials, inadequate security '
'practices in cloud environments, and failure to rotate '
'administrator tokens',
'post_incident_analysis': {'corrective_actions': 'Company shutdown; users '
'instructed to rotate '
'secrets and rebuild servers',
'root_causes': 'Unrotated administrator tokens '
'(unchanged since January 2024), '
'exposed administrative portals, '
'plaintext credential storage, '
'failure to mitigate earlier breach '
'(August 2026)'},
'recommendations': 'Rotate secrets regularly, avoid storing credentials in '
'plaintext, secure administrative portals, and implement '
'robust credential management policies',
'references': [{'source': 'Incident announcement'}],
'response': {'communication_strategy': 'Public announcement of shutdown and '
'breach details',
'containment_measures': 'Urged users to rotate secrets, revoke '
'active sessions, and rebuild '
'compromised servers'},
'stakeholder_advisories': 'Users advised to rotate secrets, revoke active '
'sessions, and rebuild compromised servers',
'title': 'Zeabur Shuts Down After Massive Security Breach Exposes Millions of '
'Records',
'type': 'Data Breach',
'vulnerability_exploited': 'Unrotated administrator tokens, exposed '
'administrative portals'}