Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes Ravie LakshmananNov 03, 2026Data Breach / Cyber Attack Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week. "An external attacker gained unauthorized access to part of Chainstack's infrastructure through a third-party component," the company said. "We detected the intrusion, cut the access paths, and are hardening our systems." According to the timeline of events shared by Chainstack, the attacker gained access to a development environment on October 26, 2026, and then escalated their access to break into "some parts of our production environment." The intrusion was subsequently detected on October 31, 2026, and the attacker's access was cut off that same day, the company noted. As part of the digital break-in, the threat actor is said to have accessed a database containing customer account information, including organization names, account holder names, the email addresses of organization’s members on Chainstack, and password hashes. "The attacker also had access to systems holding node credentials," Chainstack said. "We have no evidence they were read, but we are treating them as exposed and ask customers to rotate them." Besides rotating the node credentials, customers are advised to regenerate their platform API keys, update passwords -- including other services where the same password has been reused -- and remain alert to potential phishing attempts. Although Chainstack did not disclose any specifics about the attack, it's assessed to share overlaps with a campaign undertaken by a China-linked cluster to target high-value firms using ARTEX. The development comes as API platform WorkOS also disclosed a security incident that involved the same autonomous AI agent framework to conduct offensive security operations. The incident, which was discovered on October 30, 2026, was limited to its GTM systems, and did not affect production systems or customer platform data. Business contact details (Names, email addresses, phone numbers, job titles, and company affiliations stored in its customer relationship management system) Business account and relationship information (Customer account histories and information about sales and customer-relationship information) Customer communications (Summaries and excerpts from sales calls, support discussions, and customer Slack conversations) Operational metadata (Information about customers' use of WorkOS products, including product usage and connection or directory health) The breach is part of a growing trend in which AI agents are being employed to devise tailored attack strategies and automate different phases of the intrusion. "This increases the speed and scale of attacks that exploit weaknesses such as exposed applications and stolen credentials," WorkOS said. "It increases the need for timely remediation and monitoring that can connect suspicious activity across systems." Last week, blockchain analysis firm Chainalysis also revealed that it detected an "external actor using offensive agentic techniques" to obtain access to its systems and internal tools. As of November 2, 2026, the company has proactively taken its Reactor and Data Solutions products offline. "We are closely monitoring these systems for unusual activity and will keep you apprised of new information so you can make informed decisions for your business and operations," Chainalysis said. Another organization to be hit by ARTEX is the Dutch Institute for Vulnerability Disclosure (DIVD). The September 21, 2026, breach involved the exploitation of two zero-day flaws in the open-source Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490), enabling attackers to escalate privileges, run code remotely, and exfiltrate data. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, Cloud security, Cyber Attack, data breach, Supply Chain, Vulnerability Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces AI-Generated Fake Login Pages Are Making Account Takeovers Easier ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Secure My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security