Cloud deployment platform Zeabur says an attacker read 3,218,965 stored environment-variable records, accessed hundreds of customer databases and obtained root access to 101 managed servers. The company is now winding down, turning an already urgent credential-rotation job into a full migration deadline.

Zeabur’s preliminary incident report says the attacker used leaked internal credentials on October 14 and 15 to enter its shared clusters, some dedicated servers and internal systems. The company attributes the scale of the breach to long-lived administrator tokens stored in plaintext, public-facing administrative interfaces, excessive permissions and incomplete remediation after a separate August incident.

The confirmed platform-database exposure includes the names and values of more than 3.2 million environment variables plus account, project and service data associated with 321,810 accounts. Zeabur also says the attacker executed read commands inside 865 database services. Its logs record the commands but not every result, so the company cannot determine exactly how much database content was taken.

This is a credential emergency

Environment variables often hold the keys that let an application reach everything around it: cloud accounts, databases, payment services, AI providers, email systems and signing infrastructure. Changing a Zeabur password does not invalidate those external credentials. Each exposed secret must be revoked at the service that issued it, replaced with a new value and then redeployed.

Zeabur is telling every user to replace all credentials stored in environment variables, even if they were already rotated after the August incident. It also recommends checking provider bills and audit logs for unfamiliar activity. Shared-cluster users should rotate passwords inside their databases and revoke application sessions or tokens that may have been stored there.

The instructions are even more severe for affected Google Cloud dedicated servers. Zeabur confirmed root sign-ins on 101 servers and says attacker-controlled SSH keys were added to 50 of them. The company advises customers to treat those hosts as compromised, back up their data and rebuild rather than assuming that deleting one visible key removes every persistence mechanism.

Independent reporting from iThome matches the company’s disclosed scope and notes that the August credential rotation missed the administrator tokens and cloud keys used in this attack. Zeabur itself says a root-password storage problem discovered on September 3 had not been fixed before the intrusion. The attacker operated for roughly 36 hours before a user report prompted the investigation.

The migration clock is already running

Zeabur says service shutdowns will begin December 1. Dedicated-server renewals will stop, and each server will shut down on its expiration date. Shared-cluster workloads will be paused, although customers can restart them to retrieve data. All dedicated servers and shared clusters are scheduled to stop by December 31.

The company has not yet announced the final data-export deadline or deletion date. Customers should not treat that uncertainty as extra time. A safe migration requires verified backups, a clean destination, newly issued credentials, restored databases, DNS changes and a test that the replacement actually works. Copying a compromised server image wholesale can preserve the intruder’s foothold along with the application.

TINA's view: rotation without inventory is theater

TINA's view: Zeabur’s unusually detailed disclosure is useful, but the timeline shows why “we rotated the keys” is not a security outcome. A rotation is complete only when every credential is inventoried, replaced, stripped from backups and configuration history, limited to the permissions it needs, and monitored for reuse.

The strongest counterpoint is that Zeabur has revoked platform tokens, closed known entry points and published concrete recovery steps. Those actions reduce immediate risk. They do not undo stolen secrets, compromised hosts or the monitoring gaps that make the full scope uncertain.

This judgment would improve if independent forensics show that fewer database contents were retrieved than Zeabur currently assumes and if affected users receive precise, timely notices. It would worsen if reused credentials produce new cloud charges, repository access or downstream breaches.

For customers, the next signal is not another apology. It is evidence that old keys fail, clean systems are live elsewhere and complete backups can be restored before the first December shutdowns. Rotate first, rebuild where required, then migrate. The calendar is shorter than it looks.

This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.