Zeabur shuts down December 31 after a breach of 321,810 accounts

Zeabur, a cloud platform for deploying websites, apps and databases, is shutting down. Founder Yuanlin Lin announced the wind-down on October 17, 2026, three days after an attacker broke into its systems, and said “December 31 is the final shutdown date.” Zeabur’s preliminary incident report says the attacker read 321,810 accounts and 3,218,965 environment variable records from its platform database. It was Zeabur’s second security incident of 2026, after one in August.

What was exposed

The October 19 report says the attacker used Zeabur AWS keys and cluster admin tokens that were stored in plaintext in a private configuration repository, and root passwords for dedicated servers on Google Cloud. Zeabur writes that “the root cause of this incident lies with Zeabur.” It has not confirmed how the attacker got the first credentials. Among the findings:

• Names and values of environment variables, plus account email, username and phone number.
• Secrets of all services on the shared cluster in 9 regions (partly confirmed); commands were run in 865 database services, 736 of them n8n.
• Root sign-ins to 101 Google Cloud dedicated servers belonging to 92 users.
• All 566 zSend API keys and 11,536 access tokens, which Zeabur has revoked.

The report does not say payment data was read.

Key dates

Date	What happens
Since Oct 17	No new dedicated servers or domains can be bought
Nov 30, 2026	Deadline for balance refund requests and incident claims; migration recommended by then
Dec 1, 2026	Plans and dedicated servers stop renewing; shared-cluster services are paused
Dec 31, 2026	Zeabur stops operating and service data is deleted

Dedicated servers are shut down and deleted on their own expiry dates, which can come before December 31. Refunds cover the remaining balance, capped at the cash you actually paid, so promotional credit is not refunded. Zeabur expects payouts by January 10, 2027 for accounts that run services through December.

What to do

Zeabur tells all users to replace every credential stored in environment variables now, without waiting for an email, and to sign in again and create new access tokens. Shared-cluster users should change database passwords; n8n users should replace the encryption key and all third-party credentials. Zeabur says Google Cloud dedicated servers should be treated as compromised and rebuilt. Then back up data, move services and transfer domains out before November 30. File loss claims from the breach by the same date.

For a new home, compare plans in our VPS and app hosting guide.