Zeabur breach analysis: one unrotated admin token exposed 321,810 accounts

Hosting platform Zeabur will shut down by December 31 after a second major breach on October 14-15, 2026. Admin tokens with no expiry, unchanged since January 2024 and stored in plaintext, plus a flat internal network let an attacker reach 321,810 accounts and about 3.2 million environment variable records.

• Second breach hit October 14-15, seven weeks after the first
• Attacker ran read commands in 865 customer database containers across nine regions
• Root access gained on 101 GCP servers; SSH keys added to 50 of them
• Company will shut down entirely by December 31, 2026