Chainstack Traces Customer Data Breach to Exposed Admin Tools
Chainstack’s expanded report says an October intrusion began through a development Grafana instance using default administrator credentials, alongside an unauthenticated tool server with broad Kubernetes access and machine credentials linking development and production. The company found no evidence of a software vulnerability being exploited. Potentially exposed data included account and organisation details, email addresses, password hashes and node credentials. Customers are urged to change passwords, rotate node credentials and regenerate API keys. Chainstack’s staged node-credential rotation keeps old and new credentials active until migration is complete and old credentials are explicitly disabled; node rotation does not affect multichain authentication tokens. The report underscores the need to limit service permissions and network reach, and to verify that credential rotation is fully completed.
