Rocket.new says attacker took encrypted third-party API keys of about 0.2 per cent of users

TLDR

• Cyber Kendra reports Rocket.new told users an attacker reached production systems on 27 October and took encrypted API keys.¹
• Rocket says about 0.2 per cent of users were affected, but every user is asked to revoke and replace keys.¹
• Rocket has not said how the attacker got in or whether the keys can be decrypted, Cyber Kendra reports.¹

Rocket.new, a Surat-based AI app-building platform, has told users that an attacker broke into part of its production systems on 27 October 2026 and obtained the encrypted API keys of about 0.2 per cent of its users, Cyber Kendra reports.¹ The outlet says it saw an email notice sent on 28 October, signed by Rocket co-founder and CTO Rahul Shingala, which puts the unauthorised access between 6:32 PM and 11:58 PM UTC on 27 October.¹ Rocket says it has identified and fixed the root cause and has "confirmed the attacker no longer has access to any of our systems."¹

The keys are credentials that users hand to Rocket so the apps it generates can talk to outside services, according to Cyber Kendra, which cites Rocket's documentation as listing connectors for providers such as Anthropic, ElevenLabs and HubSpot, and its security checklist as covering keys for services such as Supabase and Stripe.¹ Users outside the affected group were told their keys were not in the compromised set but should be rotated as a precaution.¹ Rocket's notice sets out four steps: revoke each third-party key at the service where it was created, delete the old keys from the Rocket account, projects and tasks, create new keys only where still needed, and check each provider's usage and billing for unfamiliar activity.¹ Cyber Kendra adds that deleting a key inside Rocket does not stop it working, and that only revoking it at the provider cuts off anyone holding a copy.¹

Rocket did not say how many accounts the 0.2 per cent represents.¹ Cyber Kendra notes that Rocket said in an April 2026 launch announcement that more than 1.5 million people use the platform, and calculates that the affected group would be roughly 3,000 users if that figure still holds, but describes this as only its own estimate because Rocket has not published a current count or said whether the percentage covers all registered users or only those who have stored keys.¹ According to Cyber Kendra, the notice also does not say whether the attacker reached the decryption keys, how the intruder got in, when Rocket first detected the activity, or whether other data such as account details, project files or generated source code was accessed.¹

Cyber Kendra says it has asked Rocket about the entry route, exposure of encryption keys, the number of users in the 0.2 per cent and whether the incident has been reported to CERT-In, and that it will update its article with any response.¹ The outlet also links the disclosure to Zeabur, a cloud platform that it says suffered two breaches, the second affecting 321,810 accounts and more than 3.2 million environment-variable records, with Zeabur saying credentials stolen in its first breach may have enabled the October attack.¹

Why it matters: stored third-party keys, including AI-provider, database and payment credentials, are a reusable target, and Cyber Kendra's account suggests the only reliable defence for Rocket users is to revoke them at the provider rather than delete them in Rocket.¹