BlockBeats report: On November 12, Chainstack, a blockchain infrastructure provider, disclosed updated technical details regarding its prior security incident. The attacker gained access to the development environment on October 26, partially entered the production environment on October 29, and accessed the customer account database on October 31.
The company stated that potentially exposed information may include organization and account holder names, member email addresses, and password hashes. The attacker also accessed systems containing node credentials; although there is no evidence that the credentials were accessed, the company is requiring customers to rotate their credentials.
Chainstack stated that the attackers gained entry through a Grafana test instance with default admin credentials and expanded their access by exploiting an unauthenticated MCP tool server and stolen machine credentials. The investigation found that the attackers used the ARTEX framework, but no evidence of software vulnerability exploitation was discovered. The company confirmed that customer nodes, consoles, and APIs were not modified.