- The Hacker News reported four vendor incidents: Zeabur and PingCAP lost customer data, Andromeda reported credential exposure, and OpenCode says API keys may have been exposed.
- Vendors that store your API keys and passwords are part of your security perimeter, and their failures become your exposure.
- List which vendors hold your secrets, check how fast you can replace each one, and ask vendors how they protect their own credentials.
The risk you rent along with the software
Think of the superintendent of an apartment building. He holds a key to every door. Residents rarely think about it until the key ring goes missing.
Many companies now give a similar ring to the platforms that host their apps, run their databases and connect to AI tools. The ThreatsDay bulletin from The Hacker News, published October 22, shows what happens when a vendor loses its own keys.
The lesson is that your security perimeter includes every vendor that stores your secrets. The incidents below are separate, and the bulletin does not link most of them. Yet in each case the exposure started at the vendor, not at its customers.
What the vendors disclosed
Zeabur is a platform for deploying applications. It says it will wind down its service in December 2026, starting on the 1st and finishing by the 31st. The company says an attacker used leaked internal credentials on October 14 and 15. That gave access to its shared cluster, some dedicated servers and internal systems. The attacker then read the platform database.
The bulletin reports that more than 3.2 million environment variable records were taken. Data on 321,810 accounts went with them. The leaked internal credentials had been kept in plaintext, meaning readable without any decoding. This was also Zeabur's second incident this year. In August 2026 it reported an earlier intrusion, in which account details, API keys and other secrets were stolen.
PingCAP says someone used stolen service account logins to enter internal systems between September 9 and October 7, 2026. The intruder copied source code and customer-related records. These included SQL editor text, encrypted API-key values, customer contacts, contract terms, pricing and billing settings. PingCAP says it detected the problem on October 7. It began revoking the affected logins that day.
Andromeda reports unauthorized access to credentials in its environment, found on October 13. It believes the activity began around October 9 as part of an "industry-wide attack". A limited number of customer accounts were affected, and the company describes exposure of both its own and customer credentials. It says it has found no sign that customer models, datasets or training data were reached.
OpenCode has confirmed a breach of its Console. The Console lets a team pool its AI model access under API credentials managed in one place. The bulletin describes the keys as potentially exposed, not as confirmed stolen. They belong to users of models from three providers: Anthropic, OpenAI and Google. OpenCode linked the incident to a "large-scale distillation attack that impacted 1.4% of OpenCode Console users."
Genesys is a different case. On October 16 it disclosed that an outside party reached its learning management system and its customer relationship management platform. Business and account details for current and prospective customers were accessed or downloaded. Genesys says its Cloud, Engage and Engage Cloud platforms were not compromised. The core products held. Customer data sat in the systems around them.
Why stored secrets make a good target
A service account is a login used by software, not by a person. Programs use it to reach databases and other systems. Nobody types its password, so a stolen one can pass for normal activity.
Environment variables are settings an application reads when it starts. They often hold API keys and database passwords. A platform that stores millions of these records keeps a large share of its customers' access in one place.
That is why one stolen internal credential can reach so far. In Zeabur's case, leaked credentials led all the way to the platform database. A stolen API key for an AI service can let an outsider use the owner's model access. That follows from how keys work.
The reports leave gaps. The bulletin does not explain how PingCAP's intruder stayed unseen for about four weeks. It does not say whether the encrypted API-key values can be read. It does not say whether any stolen customer secrets have been used, or whether any OpenCode keys were actually taken.
Questions to put to your team
Start with an inventory. Which vendors hold your API keys, tokens and database passwords? Get the list in writing.
Then ask how fast each key can be replaced. If a vendor reported a breach tomorrow, how many hours would it take to rotate every secret it holds? Also ask whether each key is limited to the one job it needs. A narrow key opens less when stolen.
Ask vendors how they store their own internal credentials. Ask what customer data sits in side systems such as support tools, CRMs and query histories. PingCAP and Genesys both lost data from systems like these.
Finally, ask about exit. Zeabur's customers must find a new home for their workloads. Do you know where yours would go if a vendor closed within weeks?
A vendor's vault is part of your perimeter. Count the keys in it, limit what each one opens, and know how to replace them.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Hacker News.
