Zeabur to shut down after two breaches expose 3.2M records

Shutdown timeline and user impact

Zeabur, an AI cloud platform popular with vibe coders, announced it will wind down and shut all dedicated servers and shared clusters by December 31, 2026. Some services begin shutting down on December 1, 2026. The company said over 321,000 account holders need to find a new platform, and it will provide migration assistance, process account balance refunds, and offer security incident compensation. Users were urged to back up data and migrate as soon as possible. Founded in 2022 by Yuanlin Lin, Zeabur also shut down its AI Hub in September and acknowledged growing infrastructure complexity and operational difficulties alongside the security failures.

What the October breach exposed

The October 14-15 attack compromised 321,810 accounts, exposing email, username, phone number, project, environment, and service data. It also exposed 3,218,965 environment-variable records, including names and values that can contain passwords, API keys, and database credentials. Zeabur said 566 plaintext zSend API keys were revoked, 11,536 platform access tokens stored as hashes were revoked, shared clusters were exposed across nine regions, 865 database services were potentially exposed, and there were confirmed root sign-ins to 101 GCP dedicated servers belonging to 92 users. The preliminary investigation found attackers used long-lived administrative credentials stored in plaintext, while certain management interfaces were accessible from the public internet. After gaining access, the attacker reached shared clusters, dedicated servers, internal systems, and read access to the platform database. Zeabur revoked compromised credentials, blocked known attack paths, and recommended users rotate all passwords, API keys, and other stored secrets.

August breach and remediation questions

The first breach occurred on August 27, when a customer-deployed NextChat application hosted on Zeabur was exploited. The attacker gained unauthorized access to company infrastructure and eventually reached the production environment. Zeabur said it blocked the intrusion path, rotated internal credentials and passwords, and shipped security upgrades. Expert Joseph Perry said certain administrator credentials remained active after the August response, including tokens active since January 2024 without expiration. Zeabur said attackers may have obtained those credentials during the earlier breach, but that connection has not been confirmed. Perry said failing to fully remediate a major incident puts an organization at existential risk and may lead critics and attorneys to "scream negligence." He also said stopping an active attack differs from removing everything an attacker could use to return.

Sources: Cybernews