Zeabur Breach Exposes 321,810 Accounts as Developer Platform Shuts Down

The Zeabur breach exposed 321,810 account records and read about 3.2 million stored environment-variable records, the fields where many developers keep API keys and database passwords. The platform, which deploys applications straight from GitHub repositories, will shut down by the end of 2026. Anyone who stored secrets on it should treat those secrets as compromised until they have been replaced.

The company's announcement, as quoted by We Fix PC, describes the October attack as the second security incident in about two months. Coverage dates the announcement anywhere from October 17 to October 20, and the outlets do not agree on the day. Whatever the exact date, the disclosure and the shutdown plan arrived together, so the story reads as a platform winding down rather than a single security notice.

What the attacker did inside Zeabur

According to the company's announcement, an attacker used leaked internal Zeabur credentials to break into the shared cluster, some Dedicated Servers and internal Zeabur systems. The intrusion window ran from October 14 to 15, 2026, and the company says the attacker "eventually read the platform database."

The attacker went further than a single database read. Pasquale Pillitteri's breakdown reports that the attacker took about 53 production secrets, downloaded a customer's backup through a pre-signed address, added a node to the internal network and queried the platform database with an internal read-only account. Each step shows a different weakness. A read-only account was enough to pull data, and a pre-signed link grants access to whoever holds it.

Shared clusters across nine regions were affected, according to We Fix PC and cyber.hendryadrian.com. That scope matters because a shared cluster runs many customers' workloads at once, so one set of stolen credentials reaches far beyond a single account.

Which accounts and secrets the Zeabur breach exposed

The numbers depend on how they are counted, so the list below separates people from records and keys from tokens.

• 321,810 account records, with email, username, phone number, project, environment and service data exposed, per Cybernews.
• 3,218,965 environment-variable records read. The "3.2 million" headline counts records, not people, and one customer can have many records.
• 566 zSend API keys stored in plaintext. All were revoked.
• 11,536 platform access tokens stored as hashes. All were revoked.

Hashed tokens are harder to abuse than plaintext keys, which makes the 566 zSend keys the detail to watch for anyone who used that service.

Dedicated servers present the most serious exposure for customers who ran their own infrastructure on Zeabur. On servers hosted on Google Cloud, the attacker gained root access and inserted an SSH key of their own. One count puts the affected servers at 101, with root access tied to 92 users, according to TechBytes and Pasquale Pillitteri. Other reporting says SSH keys were added to 50 servers and that 16 customer disk copies were attached to attacker-controlled virtual machines. The sources do not agree on the server count, so 101 is the largest figure reported so far, not a settled total.

Zeabur says it has verified most compensation claims and is working through the remaining cases, and that it has shipped three major security-related architectural updates, per Cybernews. The coverage reviewed does not describe how claims were verified or what compensation looks like.

How the August breach set up the October attack

Zeabur says credentials stolen in an earlier breach may have enabled the October attack. That August intrusion reportedly began with a flaw in a customer's NextChat application, then moved laterally through poorly isolated internal systems, according to We Fix PC. The chain is familiar: a flaw in one customer-facing app led to internal systems, and internal credentials reached production weeks later.

One aggregator's account adds that the leaked credentials were stored in plaintext and had not been rotated since January 2024, according to OffSeq Threat Radar. That detail does not appear in the company statement as quoted in the coverage reviewed, so treat it as one outlet's claim. The root cause of the August breach and the full scope of the October attack have not been fully disclosed, and the investigation is ongoing.

Rotation is the unglamorous control that would have limited the damage here. A credential that stays valid for long periods gives an attacker time to find another way in, and a rotated credential stops being useful once it expires.

Key dates and what the December 31 shutdown means

Zeabur plans to wind down services from December 1 through December 31, 2026, according to cyber.hendryadrian.com. BleepingComputer also gives December 31 as the shutdown deadline. The OfficeChai roundup reports that the founder cited the second incident, along with growth and architecture problems, as reasons for closing.

From the date of this article, the deadline gives customers roughly ten weeks. A team running a simple static site can move in an afternoon. A team running databases, custom HTTPS setups and multi-region services has to rebuild every piece the platform was handling, and small businesses and solo developers without operations staff will carry the heaviest load.

The sources do not state where Zeabur is headquartered or what share of its customers are in the United States. Reporting describes the platform as one used by developers and small companies, which makes American customers likely to be affected, but no figure confirms the US share.

What to do now if you used Zeabur

Start with the secrets, then work outward.

1. Rotate every secret stored on the platform, including API keys, database passwords, cloud access keys and any token kept in environment variables. Rotate the ones that seem unimportant too.
2. Review every cloud account linked to Zeabur for SSH keys you did not add, new users, new instances and unfamiliar access. Start with any dedicated servers.
3. Check connected GitHub and third-party integrations, and remove any you no longer use.
4. Export your data and download backups before December 31, and keep copies outside the platform.
5. Plan the migration now. Rebuilding databases and HTTPS setups usually takes longer than teams expect.
6. Be cautious with messages that claim to come from Zeabur support or offer a compensation payout. The coverage reviewed did not identify specific scams tied to Zeabur, but phishing often follows a breach, so verify any request through a channel you already trust.

Why developer platforms keep becoming targets

October has been a hard month for developer tools. LiteLLM 1.107.0 malware stole cloud and AI keys from PyPI and Docker, and PingCAP's breach exposed TiDB Cloud billing records and API keys. Railway's breach may expose customer secrets and forced customers to rotate them. The Zeabur case fits the same pattern: a platform that concentrates secrets becomes one place where a single stolen credential can reach many customers.

The trade-off is built into the product. Platforms that hold environment variables, database connections and deployment credentials make setup easy precisely because they hold everything. Customers gain speed and lose control over where their secrets sit and who inside the platform can reach them.

Zeabur's three architectural updates suggest it sees isolation and access controls as the fix, though the coverage does not explain what changed. Customers will need that detail before deciding whether to stay, even though the shutdown has already made that choice for most of them.

What to watch next

Several open questions will decide how serious this becomes. The sources do not say whether a regulator or state attorney general will open an inquiry. A fuller root-cause report should explain how the August entry point led to credentials that were still usable in October. The compensation process also bears watching, because "most claims verified" leaves a gap that affected customers will want closed.

The migration itself deserves attention too. The December deadline will push many teams to move quickly, and rushed moves are where new misconfigurations and forgotten keys tend to appear. For now, the useful measure is how many secrets a team stored on Zeabur and how quickly it can move them before December 31.