Chainstack expanded its report on an October intrusion, saying the attacker entered through a development Grafana instance with unchanged default administrator credentials. An unauthenticated tool server with broad Kubernetes permissions and machine credentials linking development and production were also part of the access path. Chainstack says it found no evidence that a software vulnerability was exploited.
The company says account names, organisation details, email addresses and password hashes may have been exposed. It treats node credentials as exposed despite finding no evidence they were read, and asks customers to change passwords, rotate node credentials and regenerate platform API keys where used. Its documentation says old node credentials remain active until the final rotation step, with no automatic time limit; node rotation does not change a multichain authentication token.
