Chainstack Confirms AI-Powered Security Breach Exposing Customer Data and Credentials

In Brief:

• Chainstack confirmed an AI-powered security breach that exposed customer names, email addresses, and password hashes through compromised internal infrastructure systems.
• Attackers exploited default Grafana administrator credentials, accessed production databases, and used the ARTEX AI agent framework during the security intrusion.
• Chainstack urged customers to rotate credentials and change passwords while confirming that customer nodes, console settings, and APIs remained unchanged.

Blockchain infrastructure provider Chainstack has disclosed details of an AI-powered cyberattack that exposed customer information, including names, email addresses, and password hashes.

According to the company’s latest security update, attackers exploited an exposed development server before accessing production systems through compromised credentials. Chainstack identified the ARTEX AI agent framework as part of the intrusion, which occurred between October 26 and October 31.

AI-Powered Attack Exploited Weak Development Server Security

Chainstack’s investigation traced the initial intrusion to October 26, when an attacker accessed a development environment through an exposed Grafana instance. The monitoring platform operated with default administrator credentials and lacked additional security protections, creating an entry point for unauthorized access.

From there, the attacker obtained machine credentials that provided access to parts of Chainstack’s production infrastructure. By October 29, the compromised credentials had enabled access to the production database network, exposing sensitive customer information.

Significantly, Chainstack identified the ARTEX AI agent framework as part of the attacker’s operations during the intrusion. The company detected the breach on October 31 and blocked compromised access paths before completing its investigation on November 2. Despite the exposure, investigators found no unauthorized modifications to customer nodes, console settings, or API services.

Chainstack Urges Credential Rotation Following Customer Data Exposure

Following the investigation, Chainstack began notifying affected customers and recommending password changes alongside immediate credential rotation. The company currently treats node credentials as exposed, even without evidence of unauthorized modifications to customer infrastructure.

Customers can replace their node credentials directly through the Chainstack console without interrupting existing applications or services. Additionally, Chainstack warned users about potential phishing campaigns involving stolen customer contact information from the compromised database.

The company emphasized that its representatives never request passwords, authentication tokens, or private keys through customer communications. Meanwhile, the incident follows a separate security breach involving the cross-chain interoperability protocol Across, which experienced a domain takeover.

Across subsequently regained control of its website and restored normal operations following the unauthorized access. Chainstack has not disclosed the total number of affected customers or any financial losses associated with the intrusion.

The company confirmed that the breach remains contained while urging customers to secure credentials and monitor suspicious communications.