TheBlock
Chainstack said an attacker using the ARTEX AI agent framework accessed customer names, emails and password hashes in a breach that began on Oct. 26. The blockchain infrastructure provider said it detected the intrusion and cut off access on Oct. 31, and completed its investigation on Nov. 2. Customer-facing services continued to operate normally, the company said.
Why it matters
The attacker entered through an internet-exposed Grafana instance in a development cluster. Chainstack said the instance had been deployed for testing with default administrator credentials and no additional layer of protection.
The attacker obtained machine credentials that provided access to production, reached parts of that environment on Oct. 29 and accessed the database network. The route illustrates how a vulnerable test system can become an entry point to production infrastructure.
Market impact
Chainstack is treating node credentials as exposed and notifying customers to rotate them and change their passwords. It said self-service node credential rotation is available through the console without downtime.
The company said customer nodes, its console and API were not modified. It also warned customers to watch for phishing attempts, adding that it will never ask for passwords, tokens or keys.
Frequently asked questions
-
What customer information did the Chainstack attacker access?
Chainstack said customer names, emails and password hashes were accessed. It is also treating node credentials as exposed.
-
How did the attacker enter Chainstack's systems?
Chainstack said the attacker entered through an internet-exposed Grafana instance in a development cluster that used default administrator credentials and lacked an additional layer of protection.
-
When did Chainstack cut off the attacker's access?
Chainstack said it detected the intrusion and cut off access on Oct. 31. It completed its investigation on Nov. 2.
-
What should Chainstack customers do after the breach?
Chainstack is notifying customers to rotate node credentials and change passwords. It also warned them to watch for phishing attempts.
-
Were Chainstack customer nodes or services disrupted?
Chainstack said customer-facing services operated normally throughout the breach and that customer nodes, its console and API were not modified.
CryptoSlate
WuBlockchain
Lookonchain
Crypto News