It had just run into trouble in mid-October, and by the end of the month it was shut down outright. Taiwan AI startup Zeabur reaching this point left many developers stunned. Founder Lin Yuanlin announced on October 17 that the platform will cease operations in phases starting December 1, all dedicated servers will be shut down by December 31, and the team will handle refunds of account balances and compensation for losses from the August security incident. This platform, once regarded as a representative Taiwan AI deployment tool, firstIn August, a serious environment variable leak incident occurred.Less than seven weeks later, it suffered a second intrusion from the evening of October 14 to the early hours of October 15; even its own dedicated server was affected, and it ultimately ended up shutting down.
Hacked a second time: official statements changed three times
At 12:08 a.m. on October 16, Zeabur, via the status pageFirst response to the announcementOnly acknowledging that user-managed PostgreSQL and MySQL instances on shared clusters being retired had been accessed without authorization, and saying there was no evidence that dedicated servers were affected. But about 4 hours 40 minutes later, an update at 4:48 a.m. retracted that statement: “the incident is broader than initially reported,” and the attacker had read access to the databases. An update at 7:33 a.m. said that a large-scale rotation of internal credentials had temporarily caused some functionality outages. The attack occurred between 9 p.m. on October 14 and 1 a.m. on October 15, only seven weeks after the first compromise on August 27.
The leaked data includes environment variables for user services (which mostly store API keys and database passwords), account information, API tokens, and API keys for Zeabur’s email service zSend. The dedicated server hosted on Google Cloud was also accessed this time, and affected users must change the affected root passwords and SSH keys themselves. Within three hours, the scope of impact was changed from “shared clusters only” to “dedicated servers were also affected”; this time lag is critical for users who are migrating data. When announcements are revised repeatedly within a few hours, users who base their judgment on the initial statement may miss the window to rotate credentials for dedicated servers.
Both intrusions were related to a shared cluster that was being retired.
Officials acknowledged that this incident exposed shortcomings in internal credential storage and permission segregation, network isolation for shared clusters, and monitoring of anomalous access. The Legacy API Key was an authentication method Zeabur provided early on for CLI and automation scripts; it did not support scopes or expiration dates and was one of the main reasons the impact of this incident expanded. Both shared clusters and Legacy API Keys were announced in February 2026 to enter retirement, with new project creation stopped in March and new services no longer added to existing projects in April. Zeabur also promised, “Even if you choose not to migrate, we will ensure these services continue to be deployed safely and stably. This is our commitment to existing users, with no exceptions.”
Whether the October incident followed the same attack path is something Zeabur had still not explained as of the 17th. Its status page only stated that known attack vectors had been blocked, while the root cause was still under investigation. What is certain is that both incidents erupted from a shared cluster that was being retired, and both extended all the way to Zeabur’s own database; this time, dedicated servers were also added to the list of affected systems. The entry point in both incidents points to “services scheduled for retirement but actually still running online.” Officials originally promised to maintain security and stability until retirement was complete, but both times the incidents broke out from the same piece of infrastructure that had been declared retired. Monitoring and isolation clearly were not up to par in between.
What users should do: Five self-rescue steps
In its announcement about being breached for a second time, Zeabur listed steps users can take to protect themselves:
- Log in again: Zeabur has rotated the signing key for login sessions.
- Rotate all secrets stored in environment variables, including API keys and database passwords, and regenerate the Zeabur API Token.
- Users of zSend or Zeabur Email: all old keys have been revoked, and you’ll need to create a new API key.
- Users of Google Cloud dedicated servers must change the root password and delete any SSH keys they don’t recognize, especially the one named “zeabur-pentest.”
- Compared the account records and usage again to confirm there were no abnormal calls.
The status page for the August incident shows that, as of the end of August, about 63% of compensation claims had been verified and approved. The compensation covers costs incurred from the theft and misuse of AI API keys from OpenAI, Anthropic, Gemini, OpenRouter, and others. Zeabur has not yet disclosed the specific number of people affected by the October incident or the scope of the leak, saying only that it will contact affected customers directly. There are also community reports that someone on the dark web is selling a claimed 612GB complete Zeabur database, but the official statement says there is no evidence to substantiate that this data is authentic.
Announces closure: services to be discontinued in phases starting in December.
Less than three days after being hacked for the second time, Zeabur officially announced on October 17 that it would gradually wind down its platform operations: some services will be discontinued starting December 1, 2026, and all dedicated servers will be shut down by December 31. The content of the email from founder Lin Yuanlin to users is as follows:
大家好，我是 Zeabur 的創辦人林沅霖。今天要向大家宣布一個艱難的決定：我們將逐步結束 Zeabur 平台的營運。部分服務將從 2026 年 12 月 1 日起陸續停止，所有專用伺服器與共享叢集將於 12 月 31 日前關閉。
我知道，在第二次資安事件發生後不久收到這封信，對仍在使用 Zeabur 的你來說，除了對服務與資料的擔心，現在又多了一件必須處理的事：搬遷。
這些影響和額外的工作，是我們需要承擔的責任。我希望先向受到影響的每一位用戶致歉，再向大家說明這次事件、我們為什麼決定停下來，以及接下來的安排。
關於 10 月 14 日的資安事件
2026 年 10 月 14 日（UTC），Zeabur 發生了內部系統及部分客戶服務遭到外部人士入侵的資安事件。我們在偵測到異常後立即進行緊急應變。目前已確認，本次事件的影響範圍比今年八月底的事件更大。
截至目前，我們已針對所有已知的攻擊路徑採取控制措施，並持續監控異常操作。調查仍在進行，完整的影響範圍與後續處置，會隨調查進展更新，並在後續公布更完整的報告。
短時間內再次發生資安事件，辜負了大家對我們的信任。保護客戶的服務與資料是我們的責任，我們沒有把這件事做好。
如果你的服務出現異常，或懷疑受到本次事件影響，請透過 Zeabur Support 聯絡我們。對於因本次事件遭受損失的客戶，我們也會透過 Zeabur Support 受理賠償申請。
為什麼決定停下來
Zeabur 成立至今約三年半。過去一年，是我們成長最快的一段時間，也是背後的問題逐漸浮現的一段時間。
從 n8n、OpenClaw 到 Vibe Coding，AI 為雲端部署帶來了前所未有的需求。同時，我們也看到 AI 正在快速降低部署本身的門檻。我們的成長開始遇到瓶頸，也必須重新思考，Zeabur 接下來能為使用者提供什麼樣的長期價值。
另一方面，這個系統從三年半前的一個快速開發專案開始，一路為了回應市場需求而調整架構、轉換方向，也累積了越來越高的複雜度與維護難度。今年下半年的兩起資安事件，讓我們更清楚地看見，我們在系統安全與維運上仍有必須面對的不足。
在八月的事件之後，我們討論、糾結了很久。這次事件發生後，我們重新評估了繼續營運所需要的投入，以及團隊能承擔的責任，最終做出了結束營運的決定。
既然已經決定停下來，我們希望儘早讓所有受到影響的客戶知道，留下盡可能多的時間安排遷移。
我明白，對仍在使用 Zeabur 的你來說，這代表要花時間搬遷服務、備份資料，甚至重新安排原本的計畫。很抱歉，讓你在原本的工作之外，還必須承擔這些事情。
你需要留意的服務時程
目前已確定的安排如下，日期皆為 2026 年：
– 即日起：停止新的專用伺服器與網域購買，並開始受理帳戶餘額退款。
– 12 月 1 日起，專用伺服器：停用續費功能。現有專用伺服器將依各自的到期日，在 12 月 1 日至 12 月 31 日間陸續關閉。請確認你的伺服器到期日，並在到期前完成備份與遷移。
– 12 月 1 日起，共享叢集：暫停所有運行中的服務。你仍可手動恢復運行，以進行資料備份。
– 12 月 31 日：所有專用伺服器到期關閉，所有共享叢集停止服務。12 月 31 日是平台服務全部停止的日期，並不代表每一項服務都會持續運作到那一天。請依照你使用的服務及到期日，提前安排遷移。
如果你的服務有特殊情況，無法配合上述時程完成遷移，請儘早透過 Zeabur Support 告訴我們，我們會與你個別討論可行的配套方案。
資料、網域、退款與賠償
資料刪除日期、最晚匯出期限，以及 Zeabur Support 的停止服務日期，目前尚未確定，將於確認後另行公告。請先依照上述服務停止時程完成備份與遷移，不要等到資料刪除期限公布才開始準備。
在 Zeabur 購買的網域已開放自助轉出。我們會協助大家將網域轉移至其他註冊商，請將網域轉出一併納入你的遷移計畫；如果轉出過程遇到問題，也請聯絡 Zeabur Support。
帳戶餘額退款與資安事件損失賠償是兩項不同的申請，皆由 Zeabur Support 受理。聯絡時，請註明你要申請的項目，並提供相關帳戶、服務與問題說明，方便我們處理。
關於尚未完成案件的後續處理方式，我們也會在支援安排的後續公告中說明。
我們會如何協助遷移
接下來，團隊會把心力放在本次事件的調查、賠償與退款處理，以及協助大家遷移服務。
我們正在準備遷移指南，希望盡可能涵蓋大家常用的服務，以及從 Zeabur 搬到其他平台時會遇到的情況。我們也會提供可交給 Claude Code、Codex 等 Coding Agent 使用的 Markdown 指南與 Skills，作為搬遷時的輔助。
不同服務的資料、設定與部署方式不同，遷移時仍需要確認備份是否完整，以及新環境是否能正常運作。如果你不確定該怎麼開始，或在過程中遇到困難，請到 Zeabur Support 告訴我們你的情況。
接下來這段期間，支援需求可能較多，回覆速度也可能比平常慢。我們會盡力協助處理。聯絡時，請告訴我們服務是否已中斷、是否無法存取資料，以及預計到期日，讓我們了解問題的急迫程度。
謝謝過去三年多曾經支持，或現在仍在使用 Zeabur 的你。你願意把自己的專案、產品與投入的心力交給我們，是一份很重的信任。
很抱歉，我們沒能避免今天的事情發生，也沒能讓 Zeabur 繼續走下去。接下來，我們會認真處理事件善後，協助大家搬遷，把最後這段路走好。
如果有話想直接對我說，可以寫信到 yuanlin@zeabur.com。我的回覆速度可能比 Zeabur Support 慢；賠償申請、退款與技術支援，仍請透過 Zeabur Support，讓團隊協助處理。
Yuanlin Lin 林沅霖
Zeabur 創辦人
From “keeping things running until the wind-down is complete” to “shutting it down outright,” the only thing in between was a second breach. For developers who rely on Zeabur to deploy AI services, the next 6 weeks require migrating services out and rotating API keys one by one; these two tasks must be done in parallel to make it in time.
Zeabur’s outcome is a wake-up call for all AI infrastructure startups: the entry points for both intrusions pointed to “services scheduled for planned retirement but actually still running online,” and the isolation and monitoring of systems in decommissioning failed to stop the attacks. For developers still using Zeabur, the top priority now is to use the next six-week buffer period to complete migration, and during that process rotate clean every key stored in Zeabur environment variables one by one.
Source: KOCPC Chinese