Allium discloses unauthorized system access and revokes API keys during platform recovery
Allium confirms unauthorized access detected October 25. Its October 28 recovery notice revokes existing API keys and requires a new password. Core Explorer APIs are restored, but uploaded-data access and AI/MCP features remain unavailable in the notice read. Customer-data exposure is not established.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Allium application and API customers, especially integrations using existing keys or uploaded tables
- cloud · crypto
- In the wild
- Yes
- Allium confirms unauthorized access; customer-data impact remains unspecified.
What happened
Allium’s security statement acknowledges access to some systems and says affected customers were notified directly. It does not identify the entry point, enumerate accessed customer data or provide a victim count. L3 reflects a developer-facing data provider’s confirmed intrusion and credential-reset requirements; it does not assert a mass data leak.
October 25 is the detection date. The incident date here follows the October 28 public security-reset and recovery notice, rather than treating an earlier maintenance/outage message as proof of public breach disclosure. Core service restoration is not equivalent to complete recovery: uploaded tables, AI/MCP functions and datashare verification have separate status. No link to the Binance or other bridge incidents is established.
Crime-scene timeline
Oct 25, 2026
Allium detects unauthorized access, according to its later security statement
Oct 28, 2026
Recovery notice announces security resets and partial restoration
Existing API keys are being revoked; customers should create a new key or wait for one issued by their Allium contact. Password reset and MFA are recommended, while uploaded-data access and AI/MCP recovery remain restricted.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Allium security statementPrimaryCEO Ethan Chan confirms unauthorized access detected October 25, direct notification and independent investigation. It does not specify customer-data exposure.
- Allium official status and recovery noticesPrimaryOctober 28 security-reset notice requires new API keys/password; distinguishes restored core services from uploaded data, AI/MCP and ongoing datashare validation.