# Zeabur shuts down hosting by December 31 after second breach — migrate before December 1 Zeabur is closing after two security incidents. Shared-cluster services pause December 1, dedicated-server renewals end, and all hosting stops December 31. Its detailed breach report confirms millions of stored environment-variable records were read. The closure combines a credential-rotation emergency with a mandatory migration. December 31 is not a guarantee individual servers stay online until then. - Status: Active - Published: 2026-11-01T09:20:02+13:00 - Updated: 2026-11-01T09:20:02+13:00 - Categories: SaaS, Cloud & Infrastructure, Hosting, Deployment & DevOps, SaaS Operations - Tags: credential rotation, migration, security incident, Zeabur - Canonical HTML: https://beyondthe.news/dossiers/zeabur-shutdown-december-2026-breach-migration ## What changed Zeabur founder Yuanlin Lin announced on October 17, 2026 that the hosting platform would wind down after a second serious security incident. New dedicated-server and domain purchases stopped immediately. On December 1, shared-cluster services will be paused, while dedicated-server renewals will be disabled; individual servers stop on their expiration dates. By December 31 all shared clusters and dedicated servers stop. Zeabur's October 19 report says an attacker read 3,218,965 environment-variable records and 321,810 account records, accessed 101 GCP dedicated servers as root, and ran read commands in 865 database services. The incident investigation remains open. ## Why it matters Customers must migrate applications, data, DNS, scheduled jobs and integrations before services stop, while also revoking potentially stolen keys at their original providers. Merely changing host does not revoke stolen AI, database or payment credentials. December 1 may interrupt shared-cluster workloads and individual dedicated servers may expire before December 31. ## Migration timetable Zeabur stopped selling new dedicated servers and domains on October 17. From December 1 shared-cluster services pause, though manual restarts remain possible for backups. Dedicated-server renewals stop that day and servers expire individually between December 1 and December 31. The final shutdown is December 31, but the data-deletion date, final export deadline and support closure date remain undecided. ## Security incident scope and caveats Zeabur's preliminary October 19 report documents 3,218,965 environment-variable records and 321,810 account records read from the platform database, 101 GCP dedicated servers accessed as root and read commands in 865 database services. Some database commands failed, and logging gaps mean exact customer-data exfiltration cannot be established. Internal admin tokens lacked expiry and plaintext credentials remained in configuration and backup systems. Some keys rotated after an August breach were not the keys used in October. ## Rotate credentials as well as migrating Revoke and reissue keys at the provider that issued them: AI model services, cloud accounts, databases, payment processors, registries and signing services. Replacing a secret in Zeabur alone cannot invalidate a stolen copy. For GCP dedicated servers, Zeabur advises treating the host as compromised and rebuilding from trusted images where possible. Review API bills and audit logs for unexpected activity. ## Operational migration checklist Inventory each service, database, volume, object store, webhook, cron task, environment variable and domain. Export data, verify a test restore and reproduce infrastructure at a replacement host. Recreate secrets with narrower permissions, smoke-test the new deployment, move DNS and monitor errors. Include a contingency for earlier dedicated-server expiry and manual shared-cluster restart after December 1. ## Refunds and support Zeabur offers domain self-service transfer, account-balance refunds, security-incident compensation and migration assistance. Refund and compensation claims are separate support requests. Its migration guide includes a Markdown version intended for coding agents, but users remain responsible for testing their backups and cutover. ## Why the provider is closing The founder cites architectural complexity, maintenance burdens and two security incidents that exposed limits in the company's ability to operate safely. The incident is consequential for small SaaS and self-hosting users because it forces security response and migration simultaneously; it does not prove comparable hosts have the same defects. ## Key details - Shutdown announced October 17, 2026. - December 1: shared-cluster pause and dedicated-server renewals disabled. - December 31: all shared clusters and dedicated servers shut down. - 3,218,965 environment-variable records and 321,810 account records read. - 101 GCP servers accessed as root; commands run against 865 database services. - Data deletion, final export and support closure dates not finalised. ## Builder takeaways - Back up and test restores before December 1. - Check each dedicated server's individual expiry date. - Rotate AI, cloud, database and signing keys at their issuers. - Rebuild compromised dedicated servers where feasible. - Transfer domains and request refunds or compensation separately. ## What to watch - Updated shutdown timetable and export deadlines. - Final forensic findings and incident compensation. - Migration guide revisions and support availability. ## Uncertainties - Extent of actual data copying from individual databases is not confirmed. - Initial credential theft mechanism remains uncertain. - Final data deletion and support deadlines remain undecided. ## Sources - [Zeabur is shutting down: what happens next](https://zeabur.com/blogs/zeabur-is-shutting-down) — Zeabur · primary_announcement · 2026-10-17T00:00:00+13:00. Closure dates, refund, migration and support terms. - [Zeabur October 2026 security incident (preliminary report)](https://zeabur.com/blogs/october-2026-security-incident) — Zeabur · primary_incident_report · 2026-10-19T00:00:00+13:00. Confirmed records, affected systems, mitigation and uncertainty. - [Black October for AI Developer Platforms](https://www.wiz.io/blog/black-october-for-ai-developer-platforms) — Wiz Research · independent_security_research · 2026-10-30T00:00:00+13:00. Cross-provider research corroborating the Zeabur breach and closure.