Chainstack breached: customer data and password hashes accessed, node credentials treated as exposed
https://sockanalyst.com/patch-now/chainstack-breach-customer-data-node-credentials

Splunk
index=proxy (dest="*.chainstacklabs.com" OR dest="*.p2pify.com" OR dest="*.core.chainstack.com" OR url="*chainstack*")
| stats count dc(src_ip) as sources values(src_ip) as src by dest, http_user_agent
| sort - count

Sentinel
// Find every app/host still calling Chainstack endpoints so you know what to re-key after rotation
DeviceNetworkEvents
| where RemoteUrl has_any ("chainstack","p2pify.com","chainstacklabs.com")
| summarize Calls=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, InitiatingProcessFileName, RemoteUrl