Blockchain infrastructure provider Chainstack disclosed on November 3 that an attacker accessed parts of its production environment after entering a development environment through a third-party component.
The company’s timeline says the attacker gained access to development systems on October 26 and production systems on October 29. Chainstack detected the intrusion on October 31, cut off access that day and closed the incident on November 2, according to its incident report.
The attacker accessed a database containing organization names, account-holder names, member email addresses and password hashes. The intruder also had access to systems holding node credentials, although Chainstack said it has no evidence those credentials were read and is treating them as exposed. The company said customer-facing services continued operating normally, its nodes, console and API were not modified, and it does not store full payment-card details.
Chainstack said it is notifying customers and asking them to rotate node credentials and regenerate platform API keys. Self-service node-credential rotation is available in the console, and existing endpoints continue working until customers complete the rotation.
Chainstack said the incident was part of a broader AI-powered attack campaign reported in late October. WorkOS separately disclosed an incident involving an AI-assisted offensive security framework, affecting only its go-to-market systems and not production services or customer platform data, as detailed in the WorkOS breach report.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
