Chainstack Breached via Exposed Grafana Instance
Chainstack experienced a security breach due to an external attacker exploiting an exposed Grafana instance. The attacker accessed a customer account database and systems holding node credentials, but customer-facing services remained unaffected.
Chainstack, a blockchain node and RPC infrastructure provider, was breached by an external attacker who gained access through an exposed Grafana instance in a development environment. The attacker exploited default admin credentials that had not been changed and leveraged an unauthenticated MCP tool server to escalate privileges. This allowed the attacker to reach parts of the production environment and access sensitive information, including a customer account database containing password hashes and systems with node credentials.
Upon detection of the breach, Chainstack acted quickly to cut off access and advised customers to change their passwords, rotate credentials, and regenerate API keys. Despite the breach, customer-facing services were reported to be unaffected, minimizing the impact on users. The incident is associated with a broader AI-powered attack campaign utilizing the ARTEX framework, indicating a sophisticated approach to the breach.