Zeabur to Close Down After Second Massive Credential Leak

Zeabur, the cloud‑based development service, said it will shut down after suffering a second serious security breach in just two months, a compromise that revealed over 3.2 million environment‑variable entries and information tied to more than 321,000 user accounts.

Investigators traced the latest intrusion to plaintext credentials that had been kept on Zeabur’s servers. Hackers used those exposed keys to obtain unrestricted control of the infrastructure and harvest the large collection of environment variables—configuration data that typically includes API keys, database passwords and other sensitive tokens for developers.

The platform’s initial breach, disclosed earlier this year, triggered an internal audit and a public pledge to reinforce security measures. Yet the repeat of the identical vulnerability—storing privileged credentials without encryption—exposes deeper shortcomings in Zeabur’s secret‑management approach and casts doubt on the effectiveness of the fixes applied after the first incident.

The repercussions for Zeabur’s clientele are considerable. Developers who depended on the service for staging or production now risk that their application secrets have been leaked, potentially opening downstream services to additional attacks. While the company has offered help to move projects to other platforms, the decision to wind down leaves many customers racing to protect their codebases and rotate compromised keys.

The breaches come amid a surge in supply‑chain and credential‑theft attacks across the software sector. Security specialists warn that keeping secrets in plaintext breaches fundamental best‑practice rules, and they emphasize that robust secret‑management—such as encryption at rest, automated key rotation, and strict access controls—is vital for any platform that handles code and configuration data.

Regulators may now scrutinize whether Zeabur met its data‑protection duties, and impacted users might seek legal recourse for damages. Although the firm has not revealed its financial condition, the closure hints at possible bankruptcy protection or a sale. This episode stands as a warning to cloud providers about the essential need to protect the credentials that drive contemporary development pipelines.