Blockchain infrastructure provider Chainstack has disclosed a cyber attack affecting parts of its production infrastructure. According to the company, an external attacker gained unauthorized access to some systems, exposing certain customer data and password hashes. The incident has been linked by the company to a broader AI-assisted attack campaign reported in recent days.

What happened

Chainstack said an unauthorized party accessed part of its infrastructure and reached production systems containing customer-related information. Based on the available disclosure, the exposed data included password hashes and other customer data, although the full scope of affected records was not detailed in the source provided.

The company has assessed the breach as part of a larger campaign described as AI-powered. At this stage, that assessment should be treated as the company's characterization of the incident unless independently confirmed by investigators or additional official disclosures.

Why it matters for European businesses

For European companies, the incident is relevant for two reasons. First, any business relying on third-party infrastructure providers, cloud platforms, developer tools or specialised SaaS services can be affected by a supplier-side compromise. A breach at a technology provider can create downstream risk for customer accounts, application environments and operational continuity.

Second, the reference to an AI-assisted campaign reflects a broader security concern: attackers are increasingly using automation and AI tools to scale reconnaissance, credential attacks, phishing, and post-compromise activity. Whether or not AI was central to this specific intrusion, businesses should expect faster and more adaptive attack patterns.

If customer credentials or password hashes are exposed, the risk is not limited to one platform. Weak password hygiene, reused credentials, and missing multi-factor authentication can turn a single supplier incident into a wider account compromise across business systems.

Who may be affected

• Companies using Chainstack for blockchain, Web3 or API infrastructure.
• IT and security teams responsible for vendor access, identity management and incident response.
• Startups and SMEs that depend on specialist infrastructure providers but have limited in-house security resources.
• Digital businesses handling customer accounts where credential reuse could increase exposure after a supplier breach.

What companies should consider

• Review supplier notifications: If your business uses Chainstack or related services, check official incident communications and determine whether your organisation, users or environments are affected.
• Reset credentials where appropriate: If there is any possibility of exposed passwords or password hashes, rotate passwords, API keys, tokens and secrets connected to the service.
• Enforce multi-factor authentication: MFA reduces the likelihood that stolen or cracked credentials can be used to access business systems.
• Check for credential reuse: Identify whether the same or similar passwords were used across other internal or third-party platforms.
• Audit logs and access activity: Look for unusual login attempts, privilege changes, token usage or configuration changes following the reported incident.
• Strengthen vendor-risk processes: Review which external providers have access to production data, authentication workflows or critical infrastructure, and ensure incident escalation paths are clear.
• Prepare for follow-on attacks: After public breach disclosures, organisations often face phishing or social engineering attempts referencing the incident.

For regulated businesses in Europe, any confirmed impact involving personal data, service continuity or third-party security may also trigger internal legal and compliance review under existing contractual, cybersecurity or data protection obligations. The specific obligations will depend on the facts of the incident and the role of each business in the processing chain.