ZEABUR , a developer deployment platform, has announced it will shut down its shared cluster and dedicated server services by the end of December 2026, citing ongoing security problems and repeated data breaches that undermine confidence in delivering reliable service. The firm disclosed that an attacker exposed substantial data from Zeabur’s environment between 14 and 15 October, including 3.21 million environment variable records and 321,800 account records.
In total, 566 zSend API keys and 11,536 platform access tokens fell within the breach, with sensitive details such as email addresses, usernames, and phone numbers exposed in the account records.
The intrusion enabled the attacker to gain root access to 101 Google Cloud Platform (GCP) dedicated servers managed by Zeabur, adding their own SSH public keys to 50 of those servers and mounting disk copies of 16 customer servers onto attacker-controlled virtual machines.
Zeabur’s preliminary incident report attributes the breach to weak credential hygiene: plaintext credentials stored in configuration repositories, a cluster management interface exposed to the public internet, and long-lived management tokens that were never rotated. The company urges users to rotate and replace secrets stored on the platform, including API keys, cloud credentials, and database passwords.
For users of GCP dedicated servers, the guidance is to treat hosts as compromised, back up data, and rebuild affected servers. The incident underscores the risks of plaintext credentials and non-rotating tokens, reinforcing the need for robust credential management across cloud platforms.