Chainstack Discloses AI-Driven Cyberattack in Late October, Exposing Customer Account Information Chainstack, a blockchain infrastructure service provider, disclosed that it suffered an AI-driven cyberattack from October 26th to 31st, 2026. The attacker gained access to the development environment using a Grafana instance with unmodified default administrator credentials and no single sign-on protection. They then used an unauthenticated MCP tool server to gain cluster administrator privileges and stole credentials through an automated platform, ultimately gaining access to the production environment and reading customer databases. This incident resulted in the exposure of customer account information, including organization names, account holder names, member email addresses, and password hashes. The attacker also had access to the system storing node credentials; although there is no evidence that these were read, Chainstack still requires customers to rotate their node credentials.