Zeabur Cloud Platform Breach Exposes User API Keys
Zeabur, a Taiwan-based cloud deployment platform, disclosed that attackers accessed an internal service credential on 27 August 2026 and used it to steal API keys and credentials stored in user environment variables. Multiple users reported unauthorized charges to their AI service accounts, and the company pledged compensation.
What happened
On 27 August 2026, Zeabur detected that an internal service credential had been accessed without authorisation. The attackers used this credential to access environment variables in user projects stored on the platform, including API keys for OpenAI, Anthropic, xAI, and Gemini, as well as tokens for GitHub, AWS, Cloudflare, Stripe, and credentials for databases and JWT secrets.
Zeabur stated that the breach involved the open-source component LiteLLM used in its AI Hub service and suspended that service. The company said it controlled the breach, revoked the compromised credential, and blocked access routes on the same day.
Reported impact
Multiple users reported unauthorised charges to their API accounts. One user with 25 years of development experience reported API token charges spike to nearly ten times their normal daily usage. Other users reported accounts with OpenAI, Anthropic, Google Gemini, and xAI were charged unexpectedly, with one user's OpenRouter credits exhausted within minutes.
Zeabur founder and CEO Lin Yuan-lin apologised publicly and pledged compensation. The company advised users to revoke all old API keys and credentials, reset passwords, regenerate JWT secrets, and audit API usage and billing since 27 August 2026.
Index analysis
Zeabur's platform model, which stores users' API keys and credentials in environment variables for convenience, created a single point of failure where a compromised internal credential could expose multiple users' secrets simultaneously.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.