Cloud deployment platform Zeabur is shutting down after suffering its second major cybersecurity incident in less than 2 months, with attackers accessing more than 3.2 million environment variable records and compromising customer infrastructure.
The company confirmed that the October 14–15, 2026 attack exposed 3,218,965 environment variable records, information associated with 321,810 accounts, and sensitive credentials used by applications hosted on its platform.
Attackers also gained root access to 101 Google Cloud dedicated servers and executed commands inside hundreds of customer database services.
On October 17, Zeabur announced that it would permanently discontinue operations, with service shutdowns beginning December 1 and all dedicated servers and shared clusters scheduled to stop operating by December 31.
The decision follows an earlier August breach that exposed production data and cloud credentials. Zeabur acknowledged that security weaknesses identified after the first incident had not been fully addressed before the latest attack.
Millions of application secrets exposed
According to Zeabur’s October 19 preliminary incident report, attackers used compromised internal credentials to access shared clusters, dedicated servers and the company’s production database.
The confirmed database exposure included:
- 3,218,965 environment variable records: Application configuration values potentially containing API keys, database passwords, cloud credentials and other secrets.
- 321,810 account records: Account information including usernames, email addresses and telephone numbers.
- 566 zSend API keys: Stored in plaintext and subsequently revoked.
- 11,536 platform access tokens: Stored as non-reversible hashes, with all tokens revoked as a precaution.
Environment variables are commonly used to store credentials required by applications to connect to databases, cloud services, payment platforms and external APIs.
Exposure of these values can create risks extending beyond the compromised hosting provider, particularly when the same credentials remain valid in third-party systems.
The 3.2 million figure represents environment variable records, not 3.2 million unique credentials or affected customers.
Zeabur said attackers searched the stolen information for usable API keys, particularly credentials associated with artificial intelligence services.
Attackers accessed 101 servers and hundreds of databases
The intrusion extended beyond the platform’s central database.
Zeabur confirmed that attackers authenticated with root privileges to 101 dedicated servers hosted on Google Cloud, affecting infrastructure belonging to 92 users.
On 50 servers, the attackers added unauthorized SSH keys, potentially allowing continued access after the initial intrusion.
The company also identified suspicious commands executed inside 865 customer database services running on shared clusters.
Those services included PostgreSQL databases, automation platforms and applications storing third-party credentials.
Investigators assessed that attackers targeted information stored within hundreds of n8n automation environments, including credentials, workflows and configuration data.
However, Zeabur said its logs recorded the commands executed rather than their complete output, preventing investigators from determining exactly how much information was obtained from each database.
The company classified all 101 accessed dedicated servers as potentially compromised and advised affected customers to rebuild their systems.
Security failures remained unresolved after August breach
Zeabur’s investigation identified several weaknesses that allowed the October attack to spread across its infrastructure.
Internal administrative credentials had been stored in plaintext, while some privileged tokens had no expiration dates and remained valid for years.
The company also maintained administrative interfaces accessible from the public internet and stored sensitive credentials in configuration repositories and server initialization settings.
According to the incident report, attackers exploited these weaknesses to gain access to shared clusters across 9 regions and move into Zeabur’s internal network.
The attackers eventually accessed the production database using credentials obtained from compromised infrastructure.
Zeabur acknowledged that its credential rotation following the August incident was incomplete.
Some administrative tokens and cloud keys used during the October intrusion had not been replaced, despite the company’s earlier security remediation efforts.
The company has not conclusively established how the attackers initially obtained those credentials or whether the same threat actor was responsible for both incidents.
In its August breach investigation, Zeabur disclosed that attackers exploited a vulnerability in a customer-hosted application before moving through internal infrastructure and reaching production systems.
The latest incident demonstrates how previously exposed credentials and incomplete remediation can create opportunities for subsequent attacks.
Zeabur announces permanent shutdown
On October 17, Zeabur founder Yuanlin Lin announced that the company would wind down operations following the second security incident.
In its official shutdown announcement, Zeabur acknowledged that repeated breaches had exposed shortcomings in its security architecture and operational processes.
The company also cited increasing infrastructure complexity and concerns about its ability to continue operating sustainably.
The shutdown schedule includes several important dates:
- Immediately: Zeabur has stopped accepting purchases of new dedicated servers and domains.
- December 1, 2026: Dedicated server renewals will be disabled, with servers shutting down as their existing subscriptions expire.
- December 1, 2026: Running services on shared clusters will be paused, although customers can temporarily restart them to retrieve data.
- December 31, 2026: All remaining dedicated servers and shared clusters will permanently stop operating.
Zeabur emphasized that December 31 is the final shutdown date, not a guarantee that individual services will remain available until then.
Customers must complete migrations before their respective services expire.
The company is offering account balance refunds, migration assistance and a process for submitting compensation claims related to the security incident.
Final data deletion and export deadlines have not yet been announced.
Customers urged to rotate credentials and migrate services
Zeabur has warned customers that credentials exposed during the incident may still be misused, even though the company has revoked its compromised internal keys and blocked identified attack paths.
Its security incident updates advise users to replace passwords, API keys, database credentials and other secrets previously stored on the platform.
Importantly, Zeabur recommends rotating credentials again even if they were already replaced following the August breach.
Customers should prioritize the following actions:
- Rotate application secrets: Revoke exposed API keys, cloud credentials, database passwords and authentication secrets.
- Investigate server access: Review administrative activity and remove unfamiliar SSH keys or accounts.
- Rebuild compromised infrastructure: Customers using affected Google Cloud dedicated servers should rebuild their systems rather than relying solely on password changes.
- Review third-party services: Check cloud, AI and payment service accounts for unauthorized activity or unexpected charges.
- Back up application data: Export databases, configuration files and other essential information before migration.
- Plan service migration: Move applications to alternative hosting providers before their individual shutdown deadlines.
The incident also highlights broader risks associated with storing application credentials in centralized deployment platforms.
BreachNews previously reported on an alleged RapidFort breach involving AWS credentials and internal infrastructure, another case illustrating the potential consequences of exposed cloud authentication material.
Similar concerns emerged during the LiteLLM supply-chain attack that potentially affected more than 2,500 organizations, where compromised developer infrastructure created risks for downstream users.
Second breach brings cloud platform to an end
Zeabur said it has revoked compromised credentials, restricted administrative access and removed the attacker’s known access mechanisms.
However, the company continues investigating the full extent of the intrusion, including potential access to customer databases, cloud resources and previously exposed credentials.
The incident is particularly significant because the consequences extend beyond the confirmed data exposure.
Customers must now secure potentially compromised applications while simultaneously migrating their infrastructure away from a platform scheduled to disappear within weeks.
For Zeabur, the combination of repeated security failures, extensive credential exposure and operational complexity has resulted in a permanent shutdown rather than another attempt to restore normal operations.
