Chainstack disclosed that an external attacker accessed its infrastructure through a third-party component, first entering a development environment on October 26, 2026 and later breaking into parts of its production environment. The intrusion was detected on October 31, 2026 and the access was cut off the same day. The threat actor accessed a database containing customer account information – organization names, account holder names, members' email addresses – and password hashes, and also reached systems holding node credentials, which Chainstack is treating as exposed. The company asked customers to rotate node credentials, regenerate platform API keys, update passwords and watch for phishing. The breach is linked to a large-scale AI-powered campaign associated with the China-linked ARTEX framework, which has also targeted WorkOS and other firms. 1