Zeabur: attacker read 3.2 million customer environment-variable records
14-15 Oct 2026 (late catch, report 19 Oct): Zeabur says an attacker used leaked internal credentials stored in plaintext and read customer environment-variable records. It counts 3,218,965 variable records and 321,810 account records.
It revoked 566 zSend API keys. Zeabur will shut down on 31 Dec 2026. Loss claims must be filed by 30 Nov 2026. No crypto theft has been tied to it by a firm. Research snapshot from Zeabur.
369 take
Same class as the Railway secret leak a week later. If a wallet key or exchange API key ever sat in a Zeabur variable, move the funds to a new wallet and revoke the key.
Rotating the variable is not enough for a private key.
Sources