Kernel, which runs cloud browser sessions, published a public notice on 4 November 2026 of a data security incident it detected on 2 November.

Kernel says that on 24 October an unauthorized party used a compromised Kernel API key to probe for access; that on 27 October the same party used the key to gain access to a staff login to Kernel's logging provider and downloaded data from it containing a small number of Kernel API keys and app deployments' third-party secrets; and that on 3 November the same party used a compromised credential for Kernel's hosting provider account to access four GPU-enabled servers, three of which ran Kernel browser sessions and one of which contained no customer data.

Kernel says the breach affected 0.28% of its customers. It says it revoked the compromised credentials, removed the party's access to the logging provider, blocked the IP addresses involved, took the affected servers offline, rotated all credentials those servers had access to, and notified the organizations whose data was exposed with remediation guidance.

Kernel says its evidence suggests the attacker is financially motivated and that this was part of a larger cryptomining campaign; its timeline records a cryptominer being started on one server and attempted on others on 3 November. (source: Kernel)