Zeabur Discloses Data Breach of User Secrets

The cloud platform reports unauthorized access to API tokens and environment variables within its databases.

Updated on Oct. 16, 2026 in Cybersecurity

Macro detail of modular server hardware with dark metal cooling fins illuminated by sharp electric blue light. — Zeabur disclosed a data breach involving unauthorized access to API tokens and environment variables, marking its second security incident this year. AI Illustration. Upload story photo >

Live Poll

Do you trust cloud platform providers to adequately protect your sensitive digital credentials and data?

Cloud provider Zeabur revealed a security breach that exposed sensitive account details and environment variables to unauthorized actors. The incident marks the company's second data leak in just seven weeks.

Why it matters

The breach highlights ongoing security challenges at Zeabur, as the intrusion involved sensitive API tokens and email service keys. Users face potential risks from the exposure of these credentials, which can grant attackers broad access to connected accounts.

The intrusion compromised Zeabur API tokens and zSend email service keys, reaching internal databases and dedicated Google Cloud servers. The company has since permanently decommissioned the legacy shared cluster where the unauthorized access originated.

The players

Zeabur

Zeabur is a cloud deployment platform that allows developers to manage applications and internal databases.

Google Cloud

Google Cloud is a suite of cloud computing services offered by Google that hosts dedicated servers for third-party platforms.

The details

Attackers gained read access to an internal database through a legacy shared cluster, allowing them to scrape user secrets. By infiltrating these systems, the threat actors obtained account details and credentials used for external services.

August 27, 2026: A previous data breach affected company systems.
October 14, 2026, 9:00-13:00 ET: The latest unauthorized access occurred.

The Tech Race

This incident highlights the persistent vulnerability of shared cluster architecture in multi-tenant cloud environments. By moving away from these legacy structures, Zeabur is attempting to modernize its security posture against evolving persistent threats.

Users should immediately rotate their API tokens and email service keys to prevent potential unauthorized access to their applications. Customers should also review their recent account activity to check for any suspicious unauthorized operations.

The takeaway

Maintaining strict isolation between development environments is essential to preventing lateral movement during a security incident. Users who store sensitive keys in cloud environments should proactively refresh their credentials after any reported infrastructure breach.