Zeabur confirms platform-wide breach and will shut down service
An external attacker gained unauthorized access to Zeabur's internal systems and some customer services on October 14, 2026 (UTC), according to the company. The preliminary report confirms platform-wide scope, including accounts with stored environment variables, and Zeabur is winding down: all services stop and data is deleted on December 31, 2026. Migrate services and file compensation and refund claims by November 30, 2026.
What happened
On October 14, 2026 (UTC), an external attacker accessed Zeabur's internal systems and some customer services, according to the company. It is the second incident this year, with broader scope than the one in late August. The preliminary report confirms platform-wide impact, including accounts with stored environment variables, and Zeabur decided to shut down.
Why it matters
The platform stops fully on December 31, 2026, and all service data is deleted; dedicated servers may stop earlier, on their expiration dates. The company cites leaked keys and credentials as a compensation criterion, requiring secret rotation across connected systems. Customers hosting websites, applications, databases, files, email, and domains on Zeabur must migrate everything urgently.
What to do
Migrate websites, applications, databases, files, email configurations, and domains by November 30, 2026, using Zeabur's migration guide. File balance refund and incident compensation claims by November 30, as separate support tickets. Rotate exposed keys and credentials and gather third-party platform invoices covering the incident period.
For the technical team
- Affected
- Zeabur (PaaS) · The entire Zeabur platform (PaaS), including accounts with stored environment variables; no specific versions cited.
- Exploitation
- The company confirms unauthorized access and cites leaked keys and credentials in its compensation claim criteria. Investigation ongoing. The sources do not mention active post-containment exploitation or group attribution.
- Fix
- No software fix: the company is shutting down the service. All known attack paths declared contained. Customer mitigation: rotate secrets and environment variables, review third-party platform invoices, and migrate by November 30, 2026.
- Vector
- Unauthorized access by an external attacker to Zeabur's internal systems and some customer services, detected as unusual activity on October 14, 2026 (UTC). The initial vector is not described in the sources. The company says it contained all known attack paths and monitors for unusual activity; the scope is broader than the late-August incident.
- More details
- Second incident this year (late August and October 14). Timeline: purchases of new dedicated servers and domains already stopped; from December 1, 2026, renewals disabled, dedicated servers stop at their expiration dates, and shared cluster services are paused with manual restart only for backups; on December 31, 2026, all services stop and data is deleted. Compensation claims require affected accounts and services, types of leaked keys or credentials, and third-party invoices or usage records. Refunds capped at the total actually paid in cash, after final settlement, via the original payment method or Tremendous; accounts using services through December expect payouts by January 10, 2027. Founder and announcement author: Yuanlin Lin.
Timeline
Preliminary report confirms platform-wide reach and accounts with stored env vars.
Sources 1 source
- Zeabur preliminary incident report Zeabur
- Zeabur shutting down Zeabur
- Zeabur service migration, refunds, and security incident claims Zeabur
