Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes
Chainstack has confirmed a data breach exposing, customers.
Chainstack has confirmed a data breach exposing, customers.
Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure.
The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week.
Although Chainstack did not disclose any specifics about the attack, it's assessed to share overlaps with a campaign undertaken by a China-linked cluster to target high-value firms using ARTEX.
The development comes as API platform WorkOS also disclosed a security incident that involved the same autonomous AI agent framework to conduct offensive security operations.
The incident, which was discovered on October 30, 2026, was limited to its GTM systems, and did not affect production systems or customer platform data.
Anyone whose data Chainstack held is potentially affected, specifically account holders whose records were exposed.
As part of the digital break-in, the threat actor is said to have accessed a database containing customer account information, including organization names, account holder names, the email addresses of organization’s members on Chainstack, and password hashes.
Besides rotating the node credentials, customers are advised to regenerate their platform API keys, update passwords -- including other services where the same password has been reused -- and remain alert to potential phishing attempts.
Stolen credentials travel -- attackers routinely test them against unrelated services, which is why the exposure doesn't stop at the breached system's own doors.
According to the timeline of events shared by Chainstack, the attacker gained access to a development environment on October 26, 2026, and then escalated their access to break into
The intrusion was afterward detected on October 31, 2026, and the attacker's access was cut off that same day, the company noted.
The access point here was stolen login credentials, not a technical vulnerability.
Another organization to be hit by ARTEX is the Dutch Institute for Vulnerability Disclosure (DIVD).
The September 21, 2026, breach involved the exploitation of two zero-day flaws in the open-source Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490), enabling attackers to escalate privileges, run code remotely, and exfiltrate data.
Last week, blockchain analysis firm Chainalysis also revealed that it detected an to obtain access to its systems and internal tools.
The company said it has since implemented further security improvements, including moving internal applications from the legacy internal tools platform to an updated platform equipped with stronger baseline controls and adding controls to stop development-only secrets from being deployed to production systems.
If you have any relationship with Chainstack, watch for phishing attempts that reference this breach specifically -- stolen data often gets reused this way.
Any reused password from this account is worth changing immediately, especially on other services where the same password might still be active.
Any unsolicited message referencing this breach is worth treating with suspicion, since attackers commonly impersonate the breached company afterward.
What happened
Chainstack has confirmed a data breach exposing, customers.
Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure.
The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week.
What changed
Although Chainstack did not disclose any specifics about the attack, it's assessed to share overlaps with a campaign undertaken by a China-linked cluster to target high-value firms using ARTEX.
The development comes as API platform WorkOS also disclosed a security incident that involved the same autonomous AI agent framework to conduct offensive security operations.
The incident, which was discovered on October 30, 2026, was limited to its GTM systems, and did not affect production systems or customer platform data.
Who is affected
Anyone whose data Chainstack held is potentially affected, specifically account holders whose records were exposed.
As part of the digital break-in, the threat actor is said to have accessed a database containing customer account information, including organization names, account holder names, the email addresses of organization’s members on Chainstack, and password hashes.
Besides rotating the node credentials, customers are advised to regenerate their platform API keys, update passwords -- including other services where the same password has been reused -- and remain alert to potential phishing attempts.
Why it matters
Stolen credentials travel -- attackers routinely test them against unrelated services, which is why the exposure doesn't stop at the breached system's own doors.
According to the timeline of events shared by Chainstack, the attacker gained access to a development environment on October 26, 2026, and then escalated their access to break into
The intrusion was afterward detected on October 31, 2026, and the attacker's access was cut off that same day, the company noted.
Technical details
The access point here was stolen login credentials, not a technical vulnerability.
Another organization to be hit by ARTEX is the Dutch Institute for Vulnerability Disclosure (DIVD).
The September 21, 2026, breach involved the exploitation of two zero-day flaws in the open-source Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490), enabling attackers to escalate privileges, run code remotely, and exfiltrate data.
Response
Last week, blockchain analysis firm Chainalysis also revealed that it detected an to obtain access to its systems and internal tools.
The company said it has since implemented further security improvements, including moving internal applications from the legacy internal tools platform to an updated platform equipped with stronger baseline controls and adding controls to stop development-only secrets from being deployed to production systems.
What security teams should do
If you have any relationship with Chainstack, watch for phishing attempts that reference this breach specifically -- stolen data often gets reused this way.
What remains unknown
Chainstack has not disclosed the exact methods used in the breach.
The specific third-party component exploited remains unidentified.
Notification status to affected customers is unclear.