Chainstack discloses breach of customer account database as part of AI-powered campaign
What happened
Blockchain node provider Chainstack said an attacker entered through a third-party component and reached a customer account database and systems holding node credentials. The company links the intrusion to a wider AI-powered attack campaign reported in late October.
Chainstack's timeline has the development environment accessed on 26 October and parts of production on 29 October, with the access cut off on 31 October and the investigation closed on 2 November. The page says the following may have been exposed: organization names, account holder names, member email addresses and password hashes. Node credentials were on systems the attacker could reach, and the company treats them as exposed though it has no evidence they were read. Chainstack says payment card details were not stored or exposed and that customer nodes, the console and the API were not modified. It says its findings indicate the incident was part of a broader AI-powered campaign reported in late October, but its page does not describe how AI was used.
How it happened
AI-run attack: Autonomous intrusion. The attacker's own AI agent carried out the break-in, working through the steps with little human involvement.
Sources do not say whose AI model was involved. The product type was AI agent.
Impact
Data was exposed. Data involved: personal data and credentials. The impact was confined to one organization and its users or customers.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 26 Oct 2026. It became public on 3 Nov 2026, 8 days later.
Chainstack cut the access paths, is hardening its systems and emailed customers. It asks them to change passwords, rotate node credentials, regenerate platform API keys if they use the API, and watch for phishing.