Chainstack Breach Exposes Customer Data and Password Hashes

Chainstack said it was targeted in a cyber attack that granted an unauthorised party access to parts of its infrastructure, with intrusion stemming from a third‑party component. The company’s timeline shows the attacker first gained access to a development environment on 26 October 2026 and then escalated into some production systems. The breach was detected on 31 October 2026, and access was cut off the same day as Chainstack “hardens” its systems.

Chainstack reports the intruder accessed a database containing customer account information—organisation names, account holder names, and the email addresses of organisation members stored on Chainstack—and password hashes. The attacker also had access to systems holding node credentials; Chainstack says there is no evidence those credentials were read, but customers are being advised to rotate them.

Chainstack has urged customers to rotate node credentials, regenerate platform API keys, and update passwords across services where the same credentials may be reused, while remaining alert to phishing. The company’s notice suggests overlaps with a broader AI‑powered campaign linked to a China‑connected cluster targeting high‑value firms using ARTEX.

Separately, WorkOS disclosed a security incident that same week involving the same autonomous AI agent framework; its breach affected GTM systems but did not reach production data. WorkOS listed affected data types, including business contact details, account and relationship information, customer communications, and product usage metadata. The report notes other industry victims in the ARTEX campaign, including Chainalysis and the Dutch Institute for Vulnerability Disclosure (DIVD). Chainstack confirmed its investigation and ongoing containment actions, with other organisations’ disclosures cited for context.