Key facts
- Chainstack disclosed the breach on November 3, 2026.
- The data that attackers reached included organization names, the names of account holders, email addresses for members of organizations, and password hashes.
- The attacker reached systems holding customer node credentials; Chainstack found no evidence they were read and treats them as exposed.
- Chainstack told customers to rotate node credentials, regenerate platform API keys, change passwords including reuse elsewhere, and watch for phishing.
Chainstack said an outside intruder broke into its development environment and sections of its production environment through a software component from another company, and disclosed the breach Nov. 3, 2026.
Chainstack said the intruder first got into its development environment Oct. 26, 2026, and later moved into sections of its production environment. The company detected the intrusion Oct. 31, 2026, and blocked the attacker’s access that same day.
Chainstack said the data the intruder reached included organization names, the names of account holders, email addresses for members of organizations and password hashes — scrambled copies of passwords that attackers can try to guess. The company also said the intruder got into systems that hold customer node credentials — the login details for customers’ hosted nodes — and treats them as exposed even though it found no sign they were read.
Chainstack said the intrusion belonged to a wide AI-driven attack campaign made public the previous week. WorkOS disclosed an incident found Oct. 30, 2026, involving the same type of autonomous AI agent framework — software that acts without direct human control — used for offensive security operations. That breach stayed inside its go-to-market, or sales and marketing, systems, with production systems and customer platform data left unaffected.
WorkOS said accessed material included business contact details and account histories, along with summaries of sales calls, support conversations and operational metadata. It also said AI agents increase how fast and how far attacks spread when they exploit exposed applications and stolen credentials — login details taken in earlier compromises.
Chainalysis said an outside intruder used offensive agentic techniques — attacks carried out by AI agents acting on their own — to get into internal systems and tools. The company said it took its Reactor and Data Solutions offerings offline as of Nov. 2, 2026, as a containment action.
The Hacker News reported that the Dutch Institute for Vulnerability Disclosure was breached on Sept. 21, 2026, through two unknown flaws in Zammad — a customer-support platform — identified as CVE-2026-102489 and CVE-2026-102490. The flaws allowed privilege escalation, meaning access beyond what an account should have; remote code execution, meaning running code on a target machine; and data exfiltration, meaning copying data out of a system.
The Hacker News reported an assessment that the intrusion overlaps with a China-linked cluster campaign targeting high-value firms using ARTEX. Chainstack said it would not share details of the attack. “That does not change our responsibility,” the company said.
Chainstack told customers to rotate their node credentials and regenerate platform API keys — codes that let software connect to its platform. The company also told them to change passwords, including any reused elsewhere, and watch for phishing — messages that trick people into revealing passwords or other credentials.
Join the discussion