# Who tells you that you are affected: disclosure paths in four incidents

> Zeabur, Railway, 91APP and Europe's cold-chain attacks disclosed scope in different units through different channels. What a downstream user can do with each.

Source: https://sheng.page/en/posts/disclosure-paths-across-borders/ · Published: 2026-11-06 · Author: Sheng

Four incidents landed between October and early November: an admin credential leak at the PaaS Zeabur, a compromise of Railway's build infrastructure, access to an order database at 91APP, a Taiwan-listed e-commerce SaaS that runs online shops for retail brands, and attacks on refrigeration controllers in supermarkets across Europe. No source suggests a common attacker.

What I wanted to look at is how people downstream learn that they are affected. When something breaks, the scope you have to work with almost always comes from someone else's disclosure, and what you can decide depends on who speaks and in what unit. That framing is mine, and none of the notices puts it that way. Facts checked as of 6 November 2026, Taipei time.

## Who spoke, and when

Zeabur spoke for itself. Its preliminary report of 19 October came with a timeline and numbers and was blunt about the root cause: "long-lived admin credentials were stored in plaintext and could be used from the public internet." The attacker first used the admin token at 01:40 UTC on 14 October, and Zeabur started investigating at 13:56 UTC on 15 October, after a user report. How the credentials leaked could not be confirmed at the time of the report.

Railway also published its own report, labelled preliminary. The incident ran from 13:58 UTC on 20 October to 03:32 UTC on 22 October. Monitoring paged the on-call engineer about elevated latency, and the investigation found an attempted privilege escalation in the build infrastructure. The attacker pulled encrypted secrets, then obtained CI credentials that could decrypt artefacts holding further API access. The report does not say how the attacker got in.

At 91APP, the earliest warning in the published timeline came from outside the company. The attack began at 11:00 Taiwan time on 3 October. The next day a customer reported that consumers were receiving scam messages, and five more brands reported the same on 7 October. 91APP formed an incident team on 8 October, confirmed the entry point on 14 October and blocked the intrusion at 23:00 that night. On 15 October it notified the Ministry of Digital Affairs, the competent authority under Taiwan's Personal Data Protection Act, and informed its customers. The regulator spoke too: the ministry's Administration for Digital Industries began an on-site inspection on 19 October with the national cyber-security institute, and said on 20 October that some data had indeed been retrieved without authorisation, with the number affected still under investigation and any violations to be dealt with under the law. The way in was Appsmith, an unpatched internal tool; from there the attacker took a database key from GitLab and reached the order database. The chairman said brands should have been told when the team was formed on 8 October. Notices to consumers went out by email and text from 2 November, with 91APP paying the cost.

For the cold chain, the earliest public document I found came from a government agency. A CERT-FR alert of 12 October named Danfoss AK-SC and AK-SM and the xweb controllers from Copeland and Dixell, reported "de nombreuses compromissions" and said the management interfaces should not be exposed to the internet. In a notice published on 13 October and updated on 3 November, Germany's BSI said that internet-reachable refrigeration controls had been manipulated by unauthorised third parties, that food had been destroyed in some cases and that supply security in Germany was not at risk; Sweden's CERT-SE said on 2 November that it was in contact with affected grocers. None of the three names an attacker. Reuters reported on 3 November that a second wave on 2 November had hit stores in eight European countries, and quoted Richard Horne of the UK's NCSC calling it "just an early sign of what are likely to be increasingly frequent disruptions".

## What unit the scope came in

Each incident gave its scope in a different unit. Zeabur gave absolute numbers: 3,218,965 environment-variable records, 321,810 accounts and sign-ins to 101 GCP Dedicated Servers. Customers were told to rotate secrets again, including ones changed after August, because the August rotation had missed that token. A follow-up on 28 October said Zeabur could not pay third-party service charges arising from the incident, would help users seek waivers or refunds from those providers, and would cease operations on 31 December. Railway gave a percentage: "at most 1.85% of all workspaces had some environment variables potentially compromised", which is about 100,000 workspaces. The report was updated on 26 October to say the incident was resolved for existing users, sign-ups reopened on 2 November, and the 1.85% figure is unchanged, with no final report yet.

91APP gave a ceiling: at most 1,329 brands and 4,798,255 consumers, covering online orders placed between 4 April 2025 and 14 October 2026. 91APP says it could not determine which orders were involved, so it counted the maximum possible scope. The fields that may have been accessed are name, phone number, delivery address, email (if provided) and order history, with no passwords or payment data. The report says some data was stolen without saying which.

The cold chain came with "de nombreuses compromissions" (numerous compromises) and store counts. The earlier French wave hit 80 Carrefour franchise stores, and the 2 November wave hit 15 Carrefour stores in Belgium and 23 stores of the Swedish grocer ICA, which had to throw away large amounts of food.

None of these numbers tells you whether you are in it. Absolute numbers and percentages describe scale, a ceiling asks you to assume you are inside it, and "numerous" leaves you to follow CERT-FR's advice across the board.

## Traces of the same tool

ARTEX is an open-source agentic penetration-testing framework, and from mid-October several parties wrote about it publicly. A white paper by the South Korean security firm Theori, reported by DigitalToday on 15 October, found its traces in intrusions at South Korean financial institutions from late September and did not attribute them. Japan's GMO Cybersecurity by Ierae confirmed on 19 October that attack infrastructure using ARTEX had targeted about 20 Japanese companies, eight of which had already announced leaks, and judged it to be one unnamed group. 91APP's 25-day report says it found ARTEX traces in its own systems and that the toolchain matches the Korean and Japanese wave.

Separately, Microsoft said on 21 October that Storm-0940, which it describes as China-state aligned, used ARTEX to automate attacks on hundreds of organisations worldwide, and CrowdStrike on 29 October described a distinct China-nexus actor, VAPOR PANDA, hitting more than 200 organisations in at least 14 countries from 17 October. Neither report names Taiwan, and Microsoft mentions the Korean financial-sector cases without attributing them to Storm-0940. The tool is public, and no source so far connects whoever used it elsewhere with whoever hit 91APP.

## What I take from this

What I care about most after going through these is scope. Every notice gave a number or a word, and none of them could tell me whether I was in it, so I assume I am. The data was read on the provider's side, and my own logs cannot rule that out.

The other is time. In 91APP's published timeline the earliest external signal is a customer report on 4 October, and Zeabur began investigating after a user report. If I ran that platform, I would want to know whether my monitoring could have seen it before the customers did.

## Notes

- The disclosers differed. Zeabur and Railway published their own reports, Railway's marked preliminary; 91APP notified Taiwan's regulator under the Personal Data Protection Act; CERT-FR issued the cold-chain alert.
- So did the units: absolute numbers from Zeabur, a percentage from Railway, a ceiling from 91APP and "numerous" from CERT-FR.
- The earliest external signal in 91APP's timeline was a customer report of scam messages on 4 October, and the regulator was notified on 15 October.
- 91APP's 4,798,255 consumers is a ceiling, and Railway's 1.85% is a preliminary figure.
- Microsoft and CrowdStrike each attribute specific ARTEX activity, but no source links 91APP or the Korean cases to Storm-0940 or VAPOR PANDA, and no government or vendor has attributed the cold-chain attacks.
- Zeabur and Railway have no final report yet, and 91APP's figures have not been revised.

## Further reading

- [Zeabur, October 2026 security incident preliminary report](https://zeabur.com/blogs/october-2026-security-incident/): 19 October; timeline, exposure numbers and the root-cause statement, with the entry point still unconfirmed.
- [Railway, preliminary report on the October security incident](https://blog.railway.com/p/preliminary-report-october-security-incident): timeline, the 1.85% figure and the stated motive, explicitly preliminary, updated 26 October.
- [91APP, 18-day investigation report (in Chinese)](https://91app.com/blog/91app-202610-security-incident/): 22 October; timeline, entry point, attack path and the date the regulator was notified.
- [91APP, 25-day investigation report (in Chinese)](https://91app.com/blog/91app-202610-security-incident-2/): 29 October; maximum scope, fields possibly accessed and compensation.
- [DigitalToday on Theori's ARTEX white paper](https://www.digitaltoday.co.kr/en/view/115187/theori-releases-in-depth-analysis-white-paper-on-ai-hacking-tool-artex): 15 October; ARTEX traces in Korean financial-sector intrusions, no attribution.
- [Administration for Digital Industries, 20 October press release (in Chinese)](https://moda.gov.tw/ADI/news/latest-news/21118): the inspection of 91APP, with the number affected still to be confirmed.
- [Zeabur, 28 October follow-up](https://zeabur.com/blogs/october-2026-security-incident-follow-up): third-party charges it cannot pay, and the 31 December shutdown.
- [GMO Cybersecurity by Ierae, 19 October (in Japanese)](https://gmo-cybersecurity.com/blog/20261019/): about 20 Japanese companies targeted by infrastructure using ARTEX, no named attacker.
- [Microsoft on Storm-0940 and ARTEX](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/): 21 October; a China-state aligned actor using ARTEX against hundreds of organisations; Taiwan not named.
- [CrowdStrike on VAPOR PANDA and ARTEX](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/): 29 October; a separate China-nexus campaign.
- [CERT-FR alert CERTFR-2026-ALE-012 (in French)](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/): the French government's cyber-security agency on remote refrigeration controllers.
- [BSI press release (in German)](https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/261013_OT-Gefaehrdung-Kleinanlagen.html): 13 October, updated 3 November; manipulated refrigeration controls, no attacker named.
- [CERT-SE notice (in Swedish)](https://www.cert.se/2026/11/cyberangrepp-mot-uppkopplade-frys-och-kylsystem.html): 2 November; in contact with affected grocers, no technical detail.
- [Reuters, 3 November 2026 (via Investing.com)](https://www.investing.com/news/stock-market-news/european-supermarkets-rush-to-patch-vulnerabilities-after-regionwide-fridge-hack-4995896): the second wave, affected countries and retailers, and the NCSC's comment; no attribution.

> Ideas and technical judgement by Sheng; drafted with Claude · Structure led by Claude Fable, written by Claude (Opus 5.5), research by Grok, cross-checked by Codex (gpt-6-astra); facts checked as of 6 November 2026, Taipei time.