# Chainstack Says AI Attack Exposed Customer Account Data

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/55355
Published: 2026-11-12T12:08:21.000Z
Updated: 2026-11-12T12:08:21.000Z
Section: Technology

> The company said attackers read a production database from Oct. 26 to 31. Customer-facing services remained operational.

Chainstack said an AI-driven cyberattack exposed customer account data after intruders moved from a development environment into production, prompting customers to reset passwords and rotate infrastructure credentials.

The blockchain infrastructure provider said the attack ran from Oct. 26 to 31. Attackers entered its development environment through a Grafana instance with unchanged default administrator credentials and no single sign-on protection. They then used an unauthenticated MCP tool server to gain cluster administrator access, stole credentials through an automation platform and reached production, where they read a customer database.

Exposed information included organization names, account-holder names, member email addresses and password hashes. The attackers also could access a system that stored node credentials, though Chainstack said it found no evidence those credentials were read. The company still asked customers to rotate them, change passwords, regenerate platform API keys and watch for phishing messages.

Customer-facing services stayed available during the incident, and customer nodes, the console and APIs were not modified. Chainstack said it cut off the attackers’ access, found no evidence of software vulnerability exploitation and identified use of the open-source ARTEX framework.