{"schema_version":"0.10.0","id":"LR-2026-0840","record_version":1,"title":"Chainstack production breach; The Hacker News links intrusion to ARTEX-based campaign","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":52.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-04","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Only a republished copy: AI Weekly · subject to change","original_document":null,"reports_total":2,"reports_independent":0,"reports_derivative":2,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-04","history":[{"date":"2026-11-04","from_level":null,"to_level":"preliminary","reason":"Only a republished copy: AI Weekly · subject to change"}]},"sources_hash":"d3e2623648896aee406b2e852496938b97236dc477a045e005358dfb768e727b"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-11-04","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"victim","summary":"Chainstack, a Web3 infrastructure company, said an outside attacker reached parts of its production systems between October 26 and October 31, when the intrusion was detected and cut. The company said initial access came through a third-party component, and that exposed data included organization names, account holder names, member email addresses and password hashes. Node credentials sat in a system the attacker also reached; Chainstack says there is no evidence they were read but is treating them as exposed. Customers are being told to rotate node credentials, regenerate platform API keys, update passwords and watch for phishing. The Hacker News links the intrusion to a broader campaign running on ARTEX, an open-source multi-agent penetration-testing framework. Chainstack has not named the third-party component.","tags":["data-breach","credential-exposure","third-party-component","web3-infrastructure","artex-framework"],"date_detected":null,"near_miss":false,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Access paths cut and systems being hardened; customers told to rotate node credentials, regenerate platform API keys, update passwords and watch for phishing.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Rung 'major' by the live production compromise test: the source states the attacker reached parts of Chainstack's production systems.","harm_class":["privacy","third_party_security"],"affected_description":"Customers of Chainstack: organization names, account holder names, member email addresses and password hashes; node credentials treated as exposed.","protected_class_involved":null,"data_categories_exposed":["pii","credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://aiweekly.co/alerts/chainstack-discloses-breach-linked-to-artex-ai-agent-campaign","publisher":"AI Weekly","date":"2026-11-04","type":"press","title":"Chainstack Discloses Breach, Linked to ARTEX AI Agent Campaign | AI Weekly","archived_url":null,"attachment":"first_report","independence":"derivative"},{"url":"https://news.lavx.hu/article/chainstack-breach-exposes-customer-data-in-ai-powered-attack-campaign","publisher":"LavX News","date":"2026-11-04","type":"press","title":"Chainstack Breach Exposes Customer Data in AI-Powered Attack Campaign","archived_url":null,"attachment":"fingerprint","independence":"derivative"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.date_disclosed":"D","event.trigger":"D","event.detection_method":"C","event.summary":"C","event.tags":"C","event.near_miss":"C","event.adversarial_actor":"C","event.remediation":"C","event.incident_class":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity_because":"C","context.industry":"C","context.country":"D","context.denominator_available":"D"},"field_citations":{"event.detection_method":[{"source_index":0,"quote":"We detected the intrusion, cut the access paths, and are hardening our systems."}],"event.summary":[{"source_index":0,"quote":"Chainstack says an outside attacker reached parts of its production systems between October 26 and October 31, when the intrusion was detected and cut."},{"source_index":0,"quote":"The Web3 infrastructure company disclosed the breach on Tuesday, saying initial access came through a third-party component."},{"source_index":0,"quote":"What came out: a database with organization names, account holder names, member email addresses, and password hashes."},{"source_index":0,"quote":"Node credentials, the keys customers use to reach blockchain nodes, sat in a system the attacker also reached."},{"source_index":0,"quote":"Chainstack says there is no evidence those credentials were read but is treating them as exposed anyway."},{"source_index":0,"quote":"Customers are being told to rotate node credentials, regenerate platform API keys, update passwords, and watch for phishing."},{"source_index":0,"quote":"The Hacker News links the hit to a broader campaign running on ARTEX, an open-source multi-agent penetration-testing framework released this year by Chinese developers, with several forks still circulating."},{"source_index":0,"quote":"Chainstack has not named the third-party component."}],"event.tags":[{"source_index":0,"quote":"What came out: a database with organization names, account holder names, member email addresses, and password hashes."},{"source_index":0,"quote":"Chainstack says there is no evidence those credentials were read but is treating them as exposed anyway."},{"source_index":0,"quote":"The Web3 infrastructure company disclosed the breach on Tuesday, saying initial access came through a third-party component."},{"source_index":0,"quote":"The Hacker News links the hit to a broader campaign running on ARTEX, an open-source multi-agent penetration-testing framework released this year by Chinese developers, with several forks still circulating."}],"event.near_miss":[{"source_index":0,"quote":"What came out: a database with organization names, account holder names, member email addresses, and password hashes."}],"event.adversarial_actor":[{"source_index":0,"quote":"'An external attacker gained unauthorized access to part of Chainstack's infrastructure through a third-party component,' the company said."}],"event.remediation":[{"source_index":0,"quote":"We detected the intrusion, cut the access paths, and are hardening our systems."},{"source_index":0,"quote":"Customers are being told to rotate node credentials, regenerate platform API keys, update passwords, and watch for phishing."}],"event.incident_class":[{"source_index":0,"quote":"'An external attacker gained unauthorized access to part of Chainstack's infrastructure through a third-party component,' the company said."}],"impact.severity":[{"source_index":0,"quote":"Chainstack says an outside attacker reached parts of its production systems between October 26 and October 31, when the intrusion was detected and cut."}],"impact.harm_class":[{"source_index":0,"quote":"What came out: a database with organization names, account holder names, member email addresses, and password hashes."},{"source_index":0,"quote":"Chainstack says there is no evidence those credentials were read but is treating them as exposed anyway."}],"impact.affected_description":[{"source_index":0,"quote":"What came out: a database with organization names, account holder names, member email addresses, and password hashes."},{"source_index":0,"quote":"Chainstack says there is no evidence those credentials were read but is treating them as exposed anyway."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"What came out: a database with organization names, account holder names, member email addresses, and password hashes."}],"impact.severity_because":[{"source_index":0,"quote":"Chainstack says an outside attacker reached parts of its production systems between October 26 and October 31, when the intrusion was detected and cut."}],"context.industry":[{"source_index":0,"quote":"The Web3 infrastructure company disclosed the breach on Tuesday, saying initial access came through a third-party component."}]},"notes_on_gaps":"Source is AI Weekly summarising a Hacker News report, so the Chainstack facts are secondhand. Borderline qualification: no source says an AI system caused the Chainstack intrusion. The ARTEX link is The Hacker News's campaign attribution, so agent_involved is null and failure_class is null. The Chainstack-specific sentences state only an external attacker and a third-party component. Gaps: the Oct 26 to Oct 31 dates have no year, so date_occurred is null. Date_disclosed is null: the text says only 'Tuesday', and the collector metadata was not used for extraction. No detection date, no duration, no loss, no record count, no responsible party, no root cause, no regulator, and no model or harness identified. Trigger is unknown because no cause is named. Detection is recorded as victim from Chainstack's own statement. Severity major is a judgement call: production compromise is the stated test, and no loss figure is given. near_miss false follows from the stated exposure. Other items mentioned (WorkOS October 30 disclosure, Chainalysis customer notice, CrowdStrike Vapor Panda cluster) were not extracted as separate incidents: they lack stated years, agent roles, or enough detail to meet the qualification. Industry is the source's own descriptor, not a NAICS name. The 187-stories figure is not an incident field. Extractor proposed values without quotes; dropped: ['context.country', 'context.denominator_available', 'event.trigger', 'impact.reversibility', 'system.autonomy_level', 'system.deployment_context', 'system.developer']. Single secondary source; corroborate before upgrading any field to B. Source is a secondary press report (LavX News, citing The Hacker News); the only disclosure timing is 'Tuesday', so date_disclosed is null. Oct. 26 and Oct. 31 are stated without a year, so date_occurred and date_detected are null rather than inferred. No duration, record count, dollar loss, or customer count is stated. The source says the breach 'shares characteristics' with an ARTEX-attributed campaign, and researchers assess the campaign as AI-powered, but no source states that ARTEX or any AI agent was used in the Chainstack intrusion, so agent_involved, failure_class and system fields are left unset. Chainstack's own statement does not mention AI. Severity is 'major' on the live-production-compromise rung; the scope of affected customers is not stated. Detection method is recorded as 'victim' because Chainstack itself detected the intrusion; the means of detection is not stated. Root cause is not stated beyond the phrase 'through a third-party component', so it is left null. Extractor proposed values without quotes; dropped: ['event.trigger']. Single secondary source; corroborate before upgrading any field to B. [2026-11-04: evidence level set: Preliminary (Only a republished copy: AI Weekly · subject to change)]"},"context":{"industry":"Web3 infrastructure","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}