Zeabur to Close After Second Massive Credential Leak

Zeabur, the cloud‑based development service, said it will shut down after suffering a second significant security breach in just two months, a compromise that revealed over 3.2 million environment‑variable entries and information tied to more than 321,000 user accounts.

Investigators linked the newest intrusion to internal credentials that were kept in plaintext on Zeabur’s servers. Using those exposed keys, the attackers obtained full control of the platform’s infrastructure and harvested the large collection of environment variables—configuration items that typically hold API keys, database passwords and other sensitive developer tokens.

The earlier breach, disclosed earlier this year, triggered an internal audit and a public commitment to strengthen security measures. Yet the repeat of the identical vulnerability—the unencrypted handling of privileged credentials—exposed more fundamental shortcomings in Zeabur’s secret‑management approach and cast doubt on how effective the post‑breach fixes truly were.

The repercussions for Zeabur’s customers are considerable. Developers who used the service for staging or production now risk that their application secrets were exposed, which could open downstream services to additional threats. While the firm has pledged help to move projects to other platforms, the shutdown decision forces many users to hurriedly protect their codebases and rotate compromised keys.

These events occur amid a surge in supply‑chain and credential‑theft attacks throughout the software sector. Security specialists emphasize that keeping secrets in plaintext breaches fundamental best‑practice rules, and that strong secret‑management tools—such as at‑rest encryption, automated key rotation, and tight access controls—are indispensable for any service that manages code and configuration information.

Regulators could now investigate whether Zeabur met its data‑protection duties, and impacted users might explore legal recourse for compensation. Although the firm has not revealed its financial condition, the closure hints at possible bankruptcy protection or a takeover. This episode stands as a warning to cloud providers about the vital need to protect the credentials that drive contemporary development pipelines.