Skip to content
Zeabur Breach Exposes 3.2M Environment Variables and 321K Accounts

Zeabur Breach Exposes 3.2M Environment Variables and 321K Accounts

First seen 20 Oct 2026, 17:11 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 18:12 UTC
  • •An attacker accessed 3.2M environment variables and 321K accounts on Zeabur.
  • •The breach was facilitated by leaked AWS keys and plaintext admin tokens.
  • •All sessions and access tokens have been revoked; users must rotate all secrets.

On October 14-15, 2026, an attacker exploited leaked internal credentials to breach Zeabur's shared cluster and GCP Dedicated Servers, accessing 3,218,965 service environment variables and 321,810 accounts. The attacker utilized plaintext AWS keys and non-expiring cluster admin tokens to gain access. Commands were executed on 865 user database services, primarily targeting API keys. Zeabur has since revoked all sessions and access tokens, and users are advised to rotate all stored secrets immediately. The incident was detailed in a preliminary report published on October 19, 2026. The attack's root cause was identified as the use of long-lived admin credentials stored in plaintext. Users who followed guidance after a previous incident in August are reportedly outside the scope of this breach.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-14
Breach occurred
An attacker exploited leaked credentials to access Zeabur's shared cluster and GCP servers.
zeabur.com
2026-10-15
Last recorded activity
The attacker's final activity was logged on October 15 at 21:05 UTC.
zeabur.com
2026-10-19
Preliminary incident report published
Zeabur released a report detailing the breach and its impact on user data.
zeabur.com

More articles in this cluster (2)

Following this threat?

Track Zeabur in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 2

Common questions

What data was accessed in the breach?
The attacker accessed 3.2 million environment variables and 321,810 accounts, including email and phone data.
What should I do if I use Zeabur?
You should rotate all passwords, database credentials, and API keys stored on Zeabur immediately.
How did the attacker gain access?
The attacker used leaked internal credentials, including plaintext AWS keys and non-expiring admin tokens.