Zeabur Security Review: Assessing the 2026 Breach, Data Exposure Risks, and Service Shutdown

Zeabur suffered a major security breach in mid-October 2026 that exposed sensitive data from over three million records and prompted the company to announce a full shutdown by December 31. The incident marked the second breach in roughly seven weeks and led founder Yuanlin Lin to cite repeated security failures and architectural complexity as reasons for winding down operations. Users now face urgent decisions about data migration and credential rotation.

Zeabur Breach Details and Exposed Data

An attacker gained access to Zeabur’s internal systems between October 14 and 15, 2026, using compromised long-lived credentials including plaintext AWS keys and non-expiring cluster admin tokens. The intruder reached shared clusters across nine regions, 101 GCP dedicated servers belonging to 92 users, and obtained read access to the platform database for about 37 minutes on October 15.

Confirmed exposed data includes 3,218,965 service environment-variable records with names and values, 321,810 user accounts containing emails, usernames, and phone numbers, and 566 plaintext zSend API keys that were later revoked. Platform access tokens existed only as hashes and were revoked. The attacker also executed commands in 865 user database services, primarily searching for API keys tied to AI services, and performed root sign-ins on the affected GCP servers.

Zeabur’s preliminary report identified the root causes as long-lived admin credentials stored in plaintext and certain management interfaces left publicly accessible. The company accepted full responsibility. This followed an earlier incident on August 27, 2026, that also involved environment variables and production database access.

Shutdown Timeline and Recommended User Actions

On October 17, 2026, Zeabur announced the wind-down of the service. New dedicated server and domain purchases stopped immediately, while refunds and compensation claims remain available through support channels. Shared cluster services will pause after December 1, with manual restarts possible only for backups. All dedicated servers and shared clusters will shut down permanently on December 31.

Users should rotate every password, API key, and secret immediately, including those changed after the August incident. Owners of GCP dedicated servers must back up data and rebuild environments from clean images. All third-party services should be reviewed for unauthorized access, and AI-provider billing statements monitored for unexpected activity.

Zeabur status page reported the incident resolved by October 20, with all services still operational at that date. A preliminary report appeared on October 19, and further investigation updates are expected. Full scope of potential data exfiltration from databases or backups remains unclear, as does whether credentials for certain Hetzner or DigitalOcean servers were used.

• Rotate all credentials tied to Zeabur projects.
• Export data and migrate workloads before December 1.
• Monitor accounts for unusual logins through year end.
• Submit compensation claims via official support if eligible.