Short answer
Zeabur says an attacker used long-lived admin tokens to reach its shared cluster, internal network and platform database on 14 and 15 October 2026. It says the tokens had been left in plaintext after an earlier August breach. Zeabur has announced it will shut down, with services ending by 31 December 2026.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Zeabur |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Cloud hosting and developer platform |
| Country | Taiwan |
| Detected | 2026-10-15 |
| Disclosed | 2026-10-19 |
| People or records affected | 321,810 accounts and 3,218,965 environment variable records in the platform database, per Zeabur's preliminary report |
What data was exposed
- Account details for 321,810 accounts: email, username, phone number and related profile and project data
- 3,218,965 service environment variable records, names and values
- 566 zSend API keys stored in plaintext, since revoked
- Secrets and settings from shared clusters, and access to 101 GCP dedicated servers
What happened
Zeabur is a hosting and deployment platform for developers. In a preliminary report dated 19 October 2026, it said an attacker used leaked internal credentials on 14 and 15 October to reach its shared cluster, GCP dedicated servers and internal network, and then read the platform database. The first known use of the credentials was 14 October at 01:36 UTC. The last observed activity was 15 October at 21:05.
Zeabur says activity went unalerted for about 16 hours and that it began investigating after a user report.
What was exposed
According to Zeabur, the platform database held 321,810 accounts and 3,218,965 environment variable records, plus 566 zSend API keys stored in plaintext. It says 11,536 platform access tokens were stored only as irreversible hashes, and all were revoked.
On the shared cluster across nine regions, the attacker read settings and secrets, and ran commands in 865 database services. Output was not logged, so Zeabur cannot confirm what data was taken. On GCP, the attacker signed in as root to 101 servers, added SSH keys to 50, and attached copies of 16 customer disks to virtual machines it created.
How Zeabur says it happened
Zeabur says long-lived cluster admin tokens, created in January 2024 with no expiry, sat in plaintext in a configuration repository, and the admin interface was reachable from the public internet. It acknowledges that its August response did not rotate all of them and that its earlier statement that everything had been rotated was incomplete. How the attacker first obtained the credentials is unconfirmed.
The shutdown
After the breach, Zeabur announced it will wind down. Per BleepingComputer, renewals stop and shared cluster services pause on 1 December 2026, and everything ends by 31 December. Zeabur described scaling complexity as a reason. Users have a short window to move, which is also a window for scammers.
What to do
Replace all stored credentials, not only those exposed in August. Zeabur’s full checklist covers n8n encryption keys, upstream AI keys, PostgreSQL roles and GCP servers. Treat any “urgent migration” message with caution and use only links from Zeabur’s own site.
See our data breach checklist and phishing guide. It is one of several platform incidents this month, including Railway.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing to the 321,810 exposed email addresses and phone numbers, posing as Zeabur, a cloud provider or a data migration service.
- Fraudulent charges on AI and cloud accounts from stolen API keys, followed by fake refund contacts.
- Extortion or unauthorized logins using leaked database and server credentials.
- Fake 'migration' offers exploiting the shutdown to collect logins.
What to do if you are affected
- 01Replace every credential stored in Zeabur environment variables, including ones you replaced after August, and revoke the old keys with their providers first.
- 02Sign in again and create new Access Tokens. zSend users should create new API keys.
- 03Check the GitHub audit log for Zeabur App actions between 15 October 15:05 and 18:54 UTC, and review bills from 14 October.
- 04If you used a GCP dedicated server, treat it as compromised and rebuild it, or remove unknown SSH keys and replace all credentials.
- 05Plan your move off the platform and use only addresses from Zeabur's own site.
Frequently asked questions
What did the attacker access at Zeabur?
Zeabur's report says the attacker read the platform database on 15 October, which held account records and environment variables, and accessed shared cluster secrets and 101 GCP dedicated servers. It also lists tokens for Hetzner and DigitalOcean servers that leaked, though it could not confirm they were used.
Is this connected to the August incident?
Zeabur says its August rotation missed some plaintext admin tokens and keys, and it suspects the attacker got credentials then. It labels this a hypothesis, not a confirmed fact.
When is Zeabur shutting down?
According to BleepingComputer's account of the announcement, renewals end and shared cluster services pause on 1 December 2026, and dedicated servers and shared clusters stop by 31 December 2026.
Will Zeabur compensate unauthorized charges?
Zeabur's report says it will provide compensation for unauthorized charges through support tickets.
Sources
- October 2026 security incident (preliminary report), Zeabur, 2026-10-19
- Zeabur shutting down after second security breach in two months, BleepingComputer, 2026-10-20
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.