Vendor incident, severity critical

Chainstack production systems breached, exposing customer data and password hashes

Published November 3, 2026

Blockchain infrastructure provider Chainstack disclosed on Tuesday that an unauthorized external party gained access to part of its infrastructure. The title states that customer data and password hashes were exposed. Chainstack assessed the attack as part of a large-scale, AI-powered attack campaign that came to light the week before.

What's affected

• chainstackevery version

What to do

1. Follow Chainstack's official incident notice for guidance on required customer actions
2. Change your Chainstack account password and any password reused elsewhere
3. Review your Chainstack account for suspicious activity

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident chainstack-breach-2026-11

References

• https://thehackernews.com/2026/11/chainstack-reports-production-systems.html

Notice chainstack-breach-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.