Blockchain infrastructure provider Chainstack discloses attack technical details, customer account data exposed.

November 12 - According to Chainstack's disclosure, the blockchain infrastructure service provider has updated technical details of its previous security incident. The attacker entered the development environment on October 26, accessed part of the production environment on October 29, and accessed the customer account database on October 31.

The company stated that potentially exposed information includes organization and account holder names, member email addresses, and password hashes. The attacker also accessed systems storing node credentials; although there is no evidence that the credentials were read, the company still requires customers to rotate their credentials.

Chainstack said the attacker gained entry through a Grafana test instance that retained default admin credentials, and used an unauthenticated MCP tool server and stolen machine credentials to expand access. The investigation found that the attacker used the ARTEX framework, but no evidence of exploitation of software vulnerabilities was found. The company stated that customer nodes, consoles, and APIs were not modified.