Zeabur says an attacker read 3.2 million environment-variable records and data on 321,810 accounts, weeks before it shuts down

TLDR

• Zeabur says an attacker read 3,218,965 environment-variable records, names and values, plus data on 321,810 accounts.³⁴
• Zeabur says plaintext admin credentials, some unrotated since January 2024, let the attacker reach shared clusters and servers.²
• Zeabur will shut by 31 December; it urges customers to rotate exposed secrets and migrate, with claims due 30 November.¹²⁵

Zeabur, a developer hosting and deployment platform, says an attacker used leaked internal credentials on 14 and 15 October to break into its shared cluster, some dedicated servers and internal systems, and eventually read the platform database.² BleepingComputer, quoting Zeabur's incident announcement, reports the compromise spanned shared clusters in nine regions, 321,810 accounts and roughly 3.2 million environment-variable records.² Cybernews and eSecurityPlanet put the figure at 3,218,965 records, including both names and values, alongside account details such as email addresses, usernames and phone numbers.³⁴ eSecurityPlanet cautions that the record count does not mean 3.2 million customers or 3.2 million usable credentials were exposed.⁴

Zeabur also confirmed root sign-ins on 101 Google Cloud dedicated servers belonging to 92 users, with attacker SSH keys added to 50 servers and 16 copies of customer disks attached to the attacker's own virtual machines, BleepingComputer reports.² Variables that Zeabur had already moved exclusively onto customers' own servers after its August incident were outside the database exposure, although compromised hosts could still reveal them.²⁴

Zeabur's report points to credential handling as the weakness. It says internal credentials were stored in plaintext, that administrator tokens had no expiry, had not been rotated since January 2024 and were missed in the post-August rotation, and that administrator portals were reachable from the public internet.²⁴ Zeabur says the attacker probably obtained the credentials during the August breach, which began with a flaw in a customer-deployed NextChat application, but it has not confirmed this.²⁴ Customers are urged to rotate exposed credentials and secrets, revoke active sessions and rebuild compromised Google Cloud servers.² eSecurityPlanet adds that changing a database password stored in an environment variable does not change it inside the database, and that credentials should be revoked at the issuing provider and old keys checked for failure.⁴

Zeabur's founder announced the wind-down in a post dated 17 October, saying the second incident affected a broader scope than the late-August one and that its investigation was ongoing.¹ The post says the architecture had become complex and difficult to maintain and that the two incidents had made Zeabur's security and operational shortcomings clearer.¹ New dedicated-server and domain purchases have stopped, dedicated-server renewals end from 1 December, shared-cluster services pause from 1 December and can be restarted manually to back up data, and everything stops on 31 December.¹ In a 22 October notice Zeabur says requests for balance refunds and security incident claims must be submitted through support by 30 November, that claims need the affected accounts and services, the types of leaked keys or credentials and third-party invoices or usage records, and that all service data will be deleted by 31 December, with dedicated servers deleted on their expiry dates, which may be earlier.⁵

Why it matters: Anyone who stored API keys, database passwords or cloud credentials in Zeabur environment variables should treat them as exposed and revoke them at the issuing provider, because the platform's own plaintext and unrotated admin credentials were the way in, and the data will be deleted by 31 December.²⁴⁵