Zeabur to shut down after second breach exposes 321,000 accounts

Zeabur, a developer hosting and deployment platform, is shutting down after suffering its second security breach in roughly two months. Founder Yuanlin Lin announced the wind-down on October 17, and according to BleepingComputer, the October intrusion led to the theft of more than 3.2 million environment-variable records and information on 321,810 accounts, putting the API keys and secrets that developers stored on the platform at risk.

What happened

According to BleepingComputer, the first incident occurred in August 2026, when attackers exploited a flaw in a customer's NextChat application and moved through poorly isolated internal systems. They stole AWS credentials and reached the production database, exposing account information, API keys and other stored secrets.

The second incident took place on October 14–15. Zeabur's own announcement says an external attacker gained unauthorized access to its internal systems and some customer services on October 14 (UTC), and that known attack paths have since been contained while the investigation continues.

Technical details

BleepingComputer reports that the attackers used leaked internal credentials stored in plaintext to access the shared cluster, some dedicated servers, internal systems and, eventually, the platform database, across shared clusters in nine regions. Zeabur confirmed root sign-ins on 101 Google Cloud servers by 92 users, the addition of SSH keys to 50 servers, and the attachment of 16 customer disk copies to attacker-controlled virtual machines.

The company believes the credentials were likely obtained in the August breach but has not confirmed this. Zeabur acknowledged several failures, according to the report: credentials were not stored encrypted, not all admin credentials were rotated after August, and admin portals remained reachable from the internet. One admin token reportedly had no expiry and had not been rotated since January 2024.

Who is affected

All Zeabur customers are affected by the shutdown. According to Zeabur, new dedicated server and domain purchases have stopped. On December 1, renewals will be disabled and running shared-cluster services paused, and by December 31 all dedicated servers and shared clusters will stop. The data deletion date and final export deadline have not yet been announced.

The company said in its announcement that it judged it could no longer operate the service or carry the responsibilities involved after the second incident.

What to do

BleepingComputer, citing Zeabur, advises customers to rotate exposed credentials and secrets immediately, revoke all active sessions and rebuild compromised Google Cloud servers. Variables migrated to customers' own servers after the August incident were not exposed in the latest database breach, though compromised hosts could still expose them.

Zeabur urges users to back up data and migrate before each server's expiration date rather than waiting for a deletion deadline, to report any unusual activity to support, and to file separate support requests for balance refunds and for compensation over losses linked to the security incident.