Blockchain infrastructure provider Chainstack said a security incident in late October exposed customer names, email addresses and password hashes, and that it is now treating node credentials as compromised.

In an updated company blog post published Tuesday, Chainstack said the breach has been contained and that its customer-facing services remained operational throughout the incident. The company is telling customers to rotate node credentials and change passwords.

How the intrusion unfolded

Chainstack said the attacker first accessed a development environment on Oct. 26. According to the company, the intruder then reached parts of the production environment on Oct. 29 before the access paths were identified and cut off on Oct. 31.

The company said its investigation was completed on Nov. 2. It described the incident as contained in the latest update.

Entry point and movement into production

According to Chainstack, the breach began through an internet-exposed Grafana instance in a development cluster. The instance had been deployed for testing with default administrator credentials and without an added protection layer, the company said.

Chainstack said the attacker then obtained machine credentials that provided a route into production and used those credentials to access the database network. The company also said the intruder used the ARTEX AI agent framework during the attack.

What data and systems were affected

The company said the exposed customer information included names, email addresses and password hashes. It added that node credentials are being treated as exposed as a precaution.

At the same time, Chainstack said customer nodes, its console and its API were not modified. It also said customer-facing services continued to function normally during the breach.

Customer actions and next steps

Chainstack said it is notifying customers to rotate node credentials and change passwords. The company added that self-service rotation for node credentials is available through its console and can be done without downtime.

It also warned customers to be alert for phishing attempts in the wake of the incident. Chainstack said it will never ask users for passwords, tokens or keys.

Source: www.theblock.co