Zeabur
LowConfirmedDigital services
On 14 and 15 October 2026, an attacker used internal credentials of the hosting platform Zeabur to access its shared clusters, some dedicated servers and its internal systems, and then the platform database. According to Bleeping Computer, citing the company's announcement, information on 321,810 accounts and about 3.2 million environment-variable records is affected. The exposed data includes account information, API tokens and keys, and other secrets stored on the platform. Zeabur says its investigation is ongoing and has announced that its services will be shut down progressively between 1 and 31 December 2026.
Exposed API keys, tokens and other secrets can let a third party access the services and servers they grant access to for as long as they have not been replaced.
- Disclosed on
- October 17, 2026
- Incident dated
- October 14, 2026
- Accounts affected
- 321,810
- Sector
- Digital services
- Country
- International or undetermined
- Cause
- Credential stuffing
Exposed data
- Customer ID
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact