# Zeabur Discloses Second Breach in Seven Weeks, Exposing API Tokens

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/33320
Published: 2026-10-16T15:08:24.000Z
Updated: 2026-10-16T15:08:24.000Z
Section: Technology

> The company said the intrusion also reached some user-rented dedicated servers on Google Cloud and urged customers to replace exposed credentials.

Cloud deployment platform Zeabur disclosed a second breach in less than seven weeks, saying attackers accessed user secrets and some dedicated Google Cloud servers, putting connected credentials at risk.

The company said exposed data included environment variables, account details, Zeabur API tokens and API keys for its zSend email service. Zeabur also said attackers obtained read access to an internal database and accessed some user-rented dedicated servers on Google Cloud without authorization.

Zeabur placed the intrusion between 9 a.m. and 1 p.m. ET on Oct. 14 (13:00-17:00 UTC). It later expanded its initial account to include dedicated servers after first saying it had found no evidence those machines were affected.

The company urged users to sign in again, replace secrets stored in environment variables and create new Zeabur API tokens. zSend users should generate new service keys. Users of dedicated servers should reset root passwords and remove unfamiliar SSH keys; services that failed during the incident should be redeployed.

The disclosure follows a breach on Aug. 27 involving Zeabur’s legacy shared cluster. The latest intrusion also began in a shared cluster the company is phasing out.