Chainstack expanded its report on the October intrusion first disclosed on November 3. The company says the attacker used a development Grafana instance with unchanged default administrator credentials, then reached an unauthenticated tool server with broad Kubernetes permissions. Machine credentials also linked the development and production environments, although no software vulnerability exploitation was identified. Potentially exposed data includes account names, organisation details, email addresses, password hashes and node credentials. Chainstack instructs customers to change passwords, rotate all affected credentials and regenerate platform API keys, while ensuring old credentials are deactivated after migration.
Source: Read the original article
