# Chainstack breach exposed customer account data and password hashes; rotate node credentials · pwn.watch > Blockchain RPC provider Chainstack disclosed on Nov 3 2026 that an external attacker reached parts of its infrastructure through a third-party component, in what it links to a broader late-October AI-powered attack campaign. Access began in a development environment on Oct 26, reached some production systems on Oct 29, and was cut on Oct 31 after detection; the investigation closed Nov 2. The attacker accessed a database with organization names, account-holder names, member email addresses and password hashes, and had access to systems holding node credentials. Chainstack says it has no evidence node credentials were read but is treating them as exposed. Customer-facing services kept running; payment card details are not stored. Customers must change passwords, rotate node credentials (self-service in the console), regenerate platform API keys, and watch for phishing. Page: https://pwn.watch/i/chainstack-production-systems-breach-nov-2026 · generated 2026-11-04T14:14:08.250Z ## Status - Severity: high · status: live · patch: partial - Product: Chainstack (RPC / node platform) - Started: 2026-10-26 - Affected: Chainstack customers whose org/member records were in the accessed account database; anyone with node credentials or platform API keys - Fixed in: Access paths cut Oct 31 2026; customers must rotate passwords, node credentials and API keys ## Follow this incident - RSS (one item per update): https://pwn.watch/i/chainstack-production-systems-breach-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/chainstack-production-systems-breach-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/chainstack-production-systems-breach-nov-2026.json - This file: https://pwn.watch/i/chainstack-production-systems-breach-nov-2026/llms.txt ## Updates (newest first) - 2026-11-03: Chainstack publishes the incident report and asks customers to rotate passwords, node credentials and API keys; The Hacker News covers the breach. (https://chainstack.com/security-incident-nov-2026/) - 2026-10-31: Chainstack detects the intrusion and cuts the access paths the same day. (https://chainstack.com/security-incident-nov-2026/) - 2026-10-29: Attacker reaches some parts of the production environment. (https://chainstack.com/security-incident-nov-2026/) - 2026-10-26: Attacker gains access to a Chainstack development environment via a third-party component. (https://chainstack.com/security-incident-nov-2026/) ## Fix brief # Security brief: Chainstack breach exposed customer account data and password hashes; rotate node credentials Source: https://pwn.watch/i/chainstack-production-systems-breach-nov-2026 · status: live · severity: high · updated Nov 4, 2026, 12:33 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Blockchain RPC provider Chainstack disclosed on Nov 3 2026 that an external attacker reached parts of its infrastructure through a third-party component, in what it links to a broader late-October AI-powered attack campaign. Access began in a development environment on Oct 26, reached some production systems on Oct 29, and was cut on Oct 31 after detection; the investigation closed Nov 2. The attacker accessed a database with organization names, account-holder names, member email addresses and password hashes, and had access to systems holding node credentials. Chainstack says it has no evidence node credentials were read but is treating them as exposed. Customer-facing services kept running; payment card details are not stored. Customers must change passwords, rotate node credentials (self-service in the console), regenerate platform API keys, and watch for phishing. Severity detail: Customer account PII and password hashes accessed; node credentials treated as exposed though unread evidence is lacking - Product: Chainstack (RPC / node platform) ## Affected versions - Chainstack customers whose org/member records were in the accessed account database; anyone with node credentials or platform API keys ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Access paths cut Oct 31 2026; customers must rotate passwords, node credentials and API keys After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Chainstack customers: change your password (and anywhere it was reused), rotate node credentials in the console, regenerate platform API keys, and treat unexpected credential requests as phishing. ## Latest updates - Nov 3, 2026: Chainstack publishes the incident report and asks customers to rotate passwords, node credentials and API keys; The Hacker News covers the breach. - Oct 31, 2026: Chainstack detects the intrusion and cuts the access paths the same day. - Oct 29, 2026: Attacker reaches some parts of the production environment. - Oct 26, 2026: Attacker gains access to a Chainstack development environment via a third-party component. ## Advisories - [Incident report: what happened and what customers need to do](https://chainstack.com/security-incident-nov-2026/) (Chainstack) ## Write-ups & news - [Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes](https://thehackernews.com/2026/11/chainstack-reports-production-systems.html) --- Machine-readable: https://pwn.watch/i/chainstack-production-systems-breach-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.