---
title: 'Zeabur second breach reads 321,810 accounts and 3.2 million secret records; platform to shut down'
url: 'https://securteksecurity.com/news/zeabur-second-breach-leaked-credentials-321810-accounts'
markdown: 'https://securteksecurity.com/news/zeabur-second-breach-leaked-credentials-321810-accounts.md'
date: '2026-10-20'
description: 'Developer deployment platform Zeabur published a preliminary report on October 20, 2026 on a second breach in two months. On October 14 to 15, 2026, an attacker used leaked Zeabur internal credentials stored in plaintext to break into shared clusters across nine regions, some Dedicated Servers and …'
taxonomy:
  category:
    - Cybersecurity
---

# [Zeabur second breach reads 321,810 accounts and 3.2 million secret records; platform to shut down](https://securteksecurity.com/news/zeabur-second-breach-leaked-credentials-321810-accounts)

   20th Oct 2026  

Developer deployment platform Zeabur published a preliminary report on October 20, 2026 on a second breach in two months. On October 14 to 15, 2026, an attacker used leaked Zeabur internal credentials stored in plaintext to break into shared clusters across nine regions, some Dedicated Servers and internal systems, and read the platform database. Zeabur confirmed 321,810 accounts and 3,218,965 service environment variable records, names and values, were read, with root sign-ins on 101 GCP dedicated servers used by 92 users, SSH keys added to 50 servers, and 16 customer disk copies attached to attacker virtual machines. Taipei and Hong Kong backup downloads cannot be ruled out and are treated as leaked. Customers were told to rotate every stored secret.

Zeabur announced on October 17, 2026 that it is winding down: new purchases have stopped, shared clusters pause on December 1, and all services stop on December 31, 2026. The company said the credentials used in October were not covered by its August rotation, after an earlier breach that began in late August. This item is prepared as a Cybersecurity item, not a Breaches add, following the FirstVDS precedent: the confirmed scope is platform accounts and environment variable secrets, not a personal record total for the breach dashboard, and no single country filing fixes a dashboard country or industry cascade.

Sources: [Zeabur](https://zeabur.com/blogs/october-2026-security-incident); [BleepingComputer](https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/); [WindowsForum](https://windowsforum.com/news/zeabur-shuts-down-after-october-breach-rotate-secrets-and-migrate-before-december-31.449283/)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [Yonsei University portal breach exposes personal information of about 10,000 students and graduates](https://securteksecurity.com/news/yonsei-university-portal-breach-10000-students-graduates.md)