TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Northflank reported a security incident on October 30, 2026, and instructed customers to treat stored environment variables and credentials as compromised. Users reported unauthorized use of AI API keys, while the company said its investigation remained ongoing and had not shared further confirmed findings.
Northflank disclosed a security incident on October 30 and told customers to assume environment variables and stored credentials may have been exposed, after users reported unauthorized use of AI API keys held on the platform. The company’s incident status page said its investigation was ongoing; it had not published a confirmed account of how the incident occurred or how many customers were affected.
Northflank’s status updates show that the company began responding after a Wiz threat alert at 11:43 UTC on October 30. The page says Northflank engineers reviewed the alert one minute later, followed by an initial network-policy patch at 12:02 UTC and additional patches later that day. At 13:00 UTC, the company requested support from Wiz’s incident-response team. Northflank did not describe the alert’s technical details or identify a confirmed entry point.
At 13:40 UTC, Northflank told customers to rotate environment variables immediately. At 13:58 UTC, it escalated that guidance, saying customers should assume all environment variables had been decrypted and should disable or rotate keys. The company later advised rotation of secrets in workloads, secret groups and global secrets, and recommended disabling public exposure for addons where enabled. These instructions reflect precautionary guidance during the investigation; the status page did not say that every secret had been accessed.
On October 30, customers reported that AI keys supplied to Northflank had been used without authorization. Northflank advised users to revoke existing credentials with the issuing providers, create replacements, update affected secrets and workloads, and check provider usage and billing records for unexpected activity. On October 31, the company said audit logs were enabled for all customers, including free users, and that secret rotation for MySQL and Redis was available to all customers. Earlier updates said rotation for Postgres and MongoDB had been enabled.
Credential Exposure Could Reach AI Bills
Environment variables and platform secrets commonly hold credentials that workloads use to connect to external services. If a credential is exposed and then used by someone else, the account holder may face unrecognized API activity, service disruption or unexpected charges. Northflank specifically urged customers to inspect AI-provider usage and billing because users had reported unauthorized activity involving AI keys.
The possible impact is not limited to AI services. Northflank’s direction to rotate credentials across workloads, secret groups and global secrets reflects the risk that a stored credential could grant access to systems beyond the hosting platform. Customers using public-facing addons were also told to disable public exposure where enabled. The company has not confirmed the scope of any access, so the recommended response is precautionary rather than a published finding that every customer’s data or secret was taken.
The status page listed a major outage for networking, certificates, services, addons, jobs, builds, and logs and metrics during the incident. It showed the Northflank app and API as operational in the displayed status information. The outage indicators point to service availability disruption alongside the security response, but Northflank did not provide a detailed explanation linking each affected component to the incident or state how long the listed impact lasted.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
Apple Watch SE 3 GPS 44mm Smartwatch
As an affiliate, we earn on qualifying purchases.
Northflank’s Response Timeline
The company’s status page records the incident as first under investigation on October 30, 2026. Following the Wiz alert, Northflank said it reviewed the alert, deployed network-policy patches and requested assistance from Wiz’s incident-response team. The timeline identifies these response steps but does not explain what the patches changed or whether they fully addressed the suspected issue.
Northflank’s customer guidance broadened as updates were posted. It first urged immediate environment-variable rotation, then said customers should assume those variables had been decrypted. Later guidance covered credentials in workloads, secret groups and global secrets, as well as public addon exposure. The company subsequently made rotation options available for several database services and enabled audit logs for all customers. These are concrete response measures, while the underlying cause and confirmed extent of exposure remain undisclosed.
Northflank also said reports of AI-key use could be consistent with a broader pattern of attacks targeting AI credentials and pointed readers to Wiz’s “Black October” report. That is the company’s characterization of a possible connection, not confirmation that this incident was part of the same campaign. No attribution to a specific attacker appears in the supplied status updates.
“Assume all environment variables have been decrypted. Disable/rotate all keys.”
— Northflank status page, October 30, 2026, 1:58 PM UTC
Scope and Entry Point Remain Unknown
Northflank has not disclosed how the incident began, which systems or accounts were accessed, how many customers may be affected, or whether attackers obtained secrets beyond the environment variables named in its guidance. The company has not provided a final forensic assessment, a confirmed list of exposed data, or an attribution to a person or group.
Reports of unauthorized AI-key use came from users, according to Northflank. The status updates do not quantify the reports, identify the affected providers or accounts, or confirm that every instance of reported use resulted from this incident. The company said the reports may fit a wider pattern of attacks on AI credentials, but it did not confirm a link to the activity described in the referenced Wiz report.
The duration and full customer impact of the listed major outages are also not detailed in the supplied updates. Northflank’s status page showed some components as operational while marking several others as experiencing a major outage. It remains unclear when each affected service returned to normal and whether further disruption is expected.
Customers Should Rotate and Review
Northflank’s published guidance is for customers to revoke and replace stored credentials, update them in affected workloads and secret stores, and review AI-provider usage and billing records for suspicious activity. The company also advised disabling public exposure on addons where enabled. Customers who find unexpected use were asked to report it to Northflank support and the relevant provider.
The status page’s latest supplied update, posted October 31, says MySQL and Redis secret rotation is available to all customers and asks users to rotate any remaining secrets. Northflank had already announced audit logs for all customers and rotation support for Postgres and MongoDB. Further status updates and a fuller account of the investigation would clarify the scope, cause and resolution; no publication time for a final report was provided.
Key Questions
What happened at Northflank?
Northflank reported a security incident on October 30, 2026. The company advised customers to treat environment variables and stored credentials as potentially compromised after users reported unauthorized use of AI API keys.
Has Northflank confirmed that all customer secrets were accessed?
No. Northflank told customers to assume environment variables had been decrypted and rotate their credentials as a precaution. Its supplied updates do not confirm that every customer’s secrets were accessed.
What should Northflank customers do?
Northflank advises customers to revoke and replace credentials, update affected workloads and secret stores, and check provider usage and billing logs for unexpected activity. It also recommends disabling public exposure on addons where enabled.
Did the incident disrupt Northflank services?
The status page listed major outages affecting networking, certificates, services, addons, jobs, builds, and logs and metrics. It showed the Northflank app and API as operational in the displayed status information, but the supplied updates do not establish the duration or full impact of each outage.
Is the investigation complete?
No. Northflank said its investigation was ongoing and that it had no further confirmed findings to share in its October 30 evening update. The supplied status updates do not include a final cause, scope or attribution.
Source: status.northflank.com
