Kernel (kernel.sh) says an attacker downloaded some customers' Kernel API keys and app deployment secrets from its logging provider

Kernel published a public notice of a security incident on November 4, 2026. It says it detected the incident on November 2. According to the notice, an unauthorized party used a compromised Kernel API key to probe for access on October 24. On October 27, the same party used that key to gain access to a staff login to Kernel's logging provider, then accessed and downloaded data from it. Kernel says that data contained a small number of Kernel API keys and app deployments' third-party secrets. The notice does not say how the first API key was compromised.

On November 3, Kernel says, the same party used a compromised credential for Kernel's hosting provider account to reach four GPU-enabled servers. Three of them ran Kernel browser sessions and one held no customer data. Kernel's timeline shows a cryptominer started on that one server and attempts to start it on two others, and Kernel says its evidence points to a financially motivated cryptomining campaign. It says the breach affected 0.28% of its customers.

Kernel says it revoked the compromised credentials, removed the party's access to its logging provider, blocked the IP addresses involved, took the affected servers offline, and rotated all credentials those servers had access to. It says it notified the organizations whose data was exposed and gave them remediation guidance. Its next steps include wider use of scoped API keys, network controls on API key use and better API key rotation.

Our advice, not Kernel's: if you use Kernel and are not sure whether you were notified, contact Kernel before assuming you were not affected. Where a service offers scoped API keys, use them so a leaked key can do less, and limit who can sign in to your logging provider.