Zeabur Platform Breached: 3.21 Million Environment Variables and 320,000 Accounts Accessed; Founder Announces Year-End Shutdown

What Happened

Zeabur's preliminary report on October 19 stated that the root cause was long-lived administrative credentials stored in plaintext and accessible from the public internet; attackers first used Zeabur's AWS keys at 01:36 UTC on October 14, subsequently used administrative tokens to access shared clusters, read configurations and secrets across all services, logged into dedicated GCP servers, and read the platform database on October 15 ^[1].

Scope of Impact

Confirmed accessed data includes 3,218,965 service environment variables (names and values) and email addresses, usernames, and phone numbers for 321,810 accounts; 566 zSend API keys and 11,536 platform access tokens have been revoked in full; commands were executed on 865 database services across shared clusters in 9 regions; and logins were confirmed on 101 dedicated GCP servers ^[1]. Because Zeabur cannot rule out whether user database backups in Taipei and Hong Kong were downloaded, the company advises treating them as compromised ^[1]. This marks the company's second security incident following a previous breach in late August, with iThome reporting that some credentials had not been rotated after the earlier incident ^[3].

Response

Zeabur has rotated login signing keys and forced a global logout, blocked public SSH access to dedicated servers, and removed unauthorized internal network nodes planted by the attacker ^[1]. On October 17, the company halted new purchases and announced that shared cluster services will be suspended starting December 1, dedicated servers will shut down upon expiration, and the entire platform will close on December 31 ^[2].