Blockchain infrastructure provider Chainstack discloses technical details of attack, customer account data exposed

According to TechFlow, on November 12, Chainstack disclosed that the blockchain infrastructure provider updated technical details of a previous security incident. The attacker entered the development environment on October 26, entered some production environments on October 29, and accessed customer account databases on October 31.

The company said potentially exposed information includes organization and account holder names, member email addresses, and password hashes. The attacker also accessed systems containing node credentials; although there is no evidence that credentials were read, the company has asked customers to rotate credentials.

Chainstack said the attacker entered through a Grafana test instance that retained default administrator credentials, and expanded access by using an unauthenticated MCP tool server and stolen machine credentials. Investigation found the attacker used the ARTEX framework, but no evidence of software vulnerability exploitation was found. The company said customer nodes, consoles, and APIs were not modified.

Source: TechFlow