Entered the development environment through a third-party component on Oct 26, entered part of the production environment on Oct 29, and was discovered and cut off on Oct 31. May include organization names, account holder names, member emails and password hashes. Node credentials are treated as exposed.
Confirmed victims
- Chainstack
Attribution
- ARTEX basis
- The Chainstack notice does not mention ARTEX and says only broader AI-powered attack campaign. An external assessment sees overlap, which is not confirmed.
- Actor
- an external attacker.
- Same attacker?
- Not confirmed.
Sources (2)
- 2026-11-03 Victim Chainstack Incident report: what happened and what customers need to do
- 2026-11 Secondary Bonfy Chainstack Breach Reveals the AI Evidence Gap