{"slug": "chainstack-reports-production-systems-breach-exposing-customer-data-and-password", "title": "Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes", "summary": "Chainstack disclosed on Tuesday that an external attacker gained unauthorized access to part of its infrastructure through a third-party component, reaching a development environment on October 26, 2026 and escalating into some parts of its production environment before the intrusion was detected and cut off on October 31, 2026. The blockchain infrastructure provider said the attacker accessed a database of customer account information including organization names, account holder names, member email addresses and password hashes, and had access to systems holding node credentials, which Chainstack is treating as exposed and asking customers to rotate along with platform API keys and passwords. Chainstack assessed the incident shares overlaps with a China-linked campaign using the ARTEX autonomous AI agent framework, which API platform WorkOS also said was used against its GTM systems in an incident discovered October 30, 2026, and which blockchain analysis firm Chainalysis cited in an intrusion that led it to take its Reactor and Data Solutions products offline as of November 2, 2026.", "body_md": "Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure.\n\nThe incident is assessed to be part of a [large-scale, artificial intelligence (AI)-powered attack campaign](https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html) that came to light last week.\n\n“An external attacker gained unauthorized access to part of Chainstack’s infrastructure through a third-party component,” the company [said](https://chainstack.com/security-incident-nov-2026/). “We detected the intrusion, cut the access paths, and are hardening our systems.”\n\nAccording to the timeline of events shared by Chainstack, the attacker gained access to a development environment on October 26, 2026, and then escalated their access to break into “some parts of our production environment.”\n\nThe intrusion was subsequently detected on October 31, 2026, and the attacker’s access was cut off that same day, the company noted.\n\nAs part of the digital break-in, the threat actor is said to have accessed a database containing customer account information, including organization names, account holder names, the email addresses of organization’s members on Chainstack, and password hashes.\n\n“The attacker also had access to systems holding node credentials,” Chainstack said. “We have no evidence they were read, but we are treating them as exposed and ask customers to rotate them.”\n\nBesides rotating the node credentials, customers are advised to regenerate their platform API keys, update passwords — including other services where the same password has been reused — and remain alert to potential phishing attempts.\n\nAlthough Chainstack did not disclose any specifics about the attack, it’s assessed to share overlaps with a campaign undertaken by a China-linked cluster to target high-value firms using ARTEX.\n\n### WorkOS Targeted by ARTEX Too\n\nThe development comes as API platform WorkOS also [disclosed](https://workos.com/security/bulletins/october-30th-2026-data-security-incident) a security incident that involved the same autonomous AI agent framework to conduct offensive security operations. The incident, which was discovered on October 30, 2026, was limited to its GTM systems, and did not affect production systems or customer platform data.\n\nThe accessed data includes –\n\n- Business contact details (Names, email addresses, phone numbers, job titles, and company affiliations stored in its customer relationship management system)\n- Business account and relationship information (Customer account histories and information about sales and customer-relationship information)\n- Customer communications (Summaries and excerpts from sales calls, support discussions, and customer Slack conversations)\n- Operational metadata (Information about customers’ use of WorkOS products, including product usage and connection or directory health)\n\nThe breach is [part of a growing trend](https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html) in which AI agents are being employed to devise tailored attack strategies and automate different phases of the intrusion.\n\n“This increases the speed and scale of attacks that exploit weaknesses such as exposed applications and stolen credentials,” WorkOS said. “It increases the need for timely remediation and monitoring that can connect suspicious activity across systems.”\n\nLast week, blockchain analysis firm Chainalysis also [revealed](https://thehackernews.com/2026/10/chainalysis-confirms-intrusion-into.html) that it detected an “external actor using offensive agentic techniques” to obtain access to its systems and internal tools. As of November 2, 2026, the company has proactively taken its Reactor and Data Solutions products offline.\n\n“We are closely monitoring these systems for unusual activity and will keep you apprised of new information so you can make informed decisions for your business and operations,” Chainalysis [said](https://www.chainalysis.com/blog/security-incident-october-30/).\n\nAnother organization to be hit by ARTEX is the Dutch Institute for Vulnerability Disclosure (DIVD). The September 21, 2026, breach [involved](https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html#update) the exploitation of two zero-day flaws in the open-source Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490), enabling attackers to escalate privileges, run code remotely, and exfiltrate data.", "url": "https://wpnews.pro/news/chainstack-reports-production-systems-breach-exposing-customer-data-and-password", "canonical_source": "https://www.swapupdate.in/chainstack-reports-production-systems-breach-exposing-customer-data-and-password-hashes/", "published_at": "2026-11-04 00:45:50+00:00", "updated_at": "2026-11-04 01:51:40.687729+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["Chainstack", "WorkOS", "Chainalysis", "ARTEX", "Reactor", "Data Solutions"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/chainstack-reports-production-systems-breach-exposing-customer-data-and-password", "markdown": "https://wpnews.pro/news/chainstack-reports-production-systems-breach-exposing-customer-data-and-password.md", "text": "https://wpnews.pro/news/chainstack-reports-production-systems-breach-exposing-customer-data-and-password.txt", "jsonld": "https://wpnews.pro/news/chainstack-reports-production-systems-breach-exposing-customer-data-and-password.jsonld"}}