Zeabur to close after attackers access production data via unrotated credentials
Zeabur said an intruder used leaked internal credentials stored in plaintext to reach shared hosting systems and its production database, exposing about 3.2 million environment-variable records and data for 321,810 accounts. The incident followed an August breach, and the company acknowledged that administrator tokens had no expiration and had not been rotated. Zeabur is shutting down following the second compromise.
Zeabur, a developer hosting and deployment service, traced the October 14–15 intrusion to internal credentials that had been exposed in plaintext. The attacker reached shared clusters in nine regions, dedicated servers, and internal systems before reading the production database.
The company reported 321,810 affected accounts and about 3.2 million environment-variable records. It also confirmed root logins on 101 GCP servers by 92 users, SSH keys added to 50 servers, and 16 customer disk copies attached to attacker-controlled VMs. Zeabur will wind down between December 1 and December 31, 2026.
The incident could affect developers, startups, and businesses that relied on Zeabur to host applications and store secrets. Exposed environment variables and account data may require rapid credential rotation, session revocation, and server rebuilding, while the planned shutdown could force migration work and temporary service disruption. Because leaked secrets can enable further intrusions, downstream customers and their users may face added risk until affected credentials and systems are fully secured.