Chainstack tiết lộ cuộc tấn công mạng do AI điều khiển vào cuối tháng 10 năm 2026, dữ liệu khách hàng bị lộ

The Huoxing Finance report states that blockchain infrastructure provider Chainstack disclosed it suffered an AI-driven cyberattack between October 26 and 31, 2026. The attackers gained access to the development environment through a Grafana instance with unchanged default admin credentials and no single sign-on protection. They then obtained cluster administrator privileges by exploiting an unauthenticated MCP tool server, used an automated platform to steal credentials, and ultimately accessed the production environment to read customer databases. This incident exposed customer account information, including organization names, account holder names, member email addresses, and password hashes. The attackers also gained access to systems storing node credentials; although there is no evidence the data was read, Chainstack still requires customers to rotate their node credentials. Chainstack stated that customer-facing services remained operational during the incident, and customer nodes, consoles, and APIs were not modified. The investigation found that the attackers used the open-source framework ARTEX, with no evidence of software vulnerabilities being exploited. Chainstack has severed the attackers' access paths and urges customers to change passwords, rotate node credentials, regenerate platform API keys, and remain vigilant against phishing attempts.