TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Northflank warned customers on October 30 to assume environment variables stored on its platform had been decrypted and to rotate secrets and credentials. The company reported customer claims of unauthorized use of AI API keys, but said its investigation was ongoing and it had no further confirmed findings to share at that time.
Cloud platform provider Northflank disclosed a security incident on October 30 and urged customers to treat all stored environment variables as potentially decrypted, rotate their credentials, and review provider usage for suspicious activity. The company also reported that users had told it their AI API keys were used without authorization; Northflank said its investigation was ongoing and had not yet produced further confirmed findings.
Northflank’s status page first listed the event as an incident under investigation at 1:40 p.m. UTC on October 30, advising customers to rotate environment variables immediately. At 1:58 p.m., the company escalated its guidance: customers should assume all environment variables had been decrypted and disable or rotate their keys. The advice covered secrets on workloads, secret groups, and global secrets.
At 3:12 p.m., Northflank said it had enabled secret rotation for Postgres and MongoDB for all users. It also recommended disabling public exposure on add-ons where enabled. At 7:28 p.m., the company said it had no additional confirmed findings and repeated its direction to rotate all secrets and credentials, including those used by workloads and add-ons.
At 11:38 p.m., Northflank said users had reported unauthorized use of AI API keys supplied to its platform. It told customers to revoke existing credentials with the issuing providers, create replacements, update affected secrets and workloads, and inspect AI-provider usage and billing logs. At 1:04 a.m. UTC on October 31, it said audit logs had been enabled for all customers, including free users.
Customer Credentials and Service Disruption
The incident raises immediate concerns for customers whose applications rely on secrets stored in Northflank. If credentials were exposed, an unauthorized party could potentially use them to access connected services or generate charges through AI providers. Northflank’s instruction to revoke old credentials and check billing records is a precautionary response; the company has not publicly established how many customers were affected or confirmed the scope of any access.
The event also disrupted platform availability. Northflank’s status page marked networking, certificates, services, add-ons, jobs, builds, and logs and metrics as experiencing a major outage. It reported the Northflank app as operational at 99.82% uptime, the API as operational at 100%, and the marketing site and documentation at 100%. These are status-page figures, not a complete account of customer impact or outage duration.
For affected users, rotating keys can require changes across workloads and linked providers, while reviewing provider billing may help identify unexpected activity. The advice to disable public access to add-ons addresses a separate exposure risk Northflank highlighted during its response. The company has not said whether the outage was caused by the security incident or was a separate operational consequence.
Products Worth Considering
Sonos Era 100 SL Compact, Microphone-Free Speaker – Black
DJI Mini 5 Pro Fly More Combo Plus with DJI RC 2
Logitech MX Brio Ultra HD 4K Webcam, Graphite
As an affiliate, we earn on qualifying purchases.
Incident Timeline and Response
Northflank’s status history records a sequence of response steps after the incident was identified on October 30. At 11:43 a.m. UTC, the timeline says a Wiz threat alert was received; Northflank engineers reviewed it at 11:44 a.m. The company recorded an initial network-policy patch at 12:02 p.m., followed by additional patching at 12:50 p.m. and 1:05 p.m. It also said it requested support from Wiz’s incident-response team at 1 p.m.
Northflank later linked the reported AI-key activity to a possible broader pattern of attacks targeting AI credentials, saying similar IP addresses appeared in Wiz’s “Black October” report. That is the company’s stated comparison, not a confirmed attribution of this incident to a particular actor or campaign. The status updates do not explain the technical vulnerability, how access may have occurred, or whether the patches fully addressed the issue.
The company’s guidance changed as the response developed: from an initial instruction to rotate environment variables to a broader assumption that all such variables may have been decrypted. Its later updates addressed database secret rotation, public add-on exposure, customer reports about AI keys, and audit-log availability. The status page does not provide a final incident report.
“Assume all environment variables have been decrypted. Disable/rotate all keys.”
— Northflank, status update at 1:58 p.m. UTC on October 30
Scope and Cause Remain Unknown
Northflank has not publicly specified how the incident occurred, when any unauthorized access began, or whether an attacker obtained environment variables. Its instruction to assume those variables were decrypted is a precaution, not a published forensic conclusion. The status updates also do not identify the number of affected customers or confirm whether reported AI-key use resulted directly from this incident.
The company has not disclosed whether customer data beyond secrets may have been accessed, whether any credentials were used to reach other systems, or whether the reported activity is connected to the broader pattern referenced in the Wiz report. It is also unclear how long the listed major outages lasted and whether they were directly related to the security response. No final investigation findings or confirmed attribution were included in the supplied updates.
Customer Rotation and Company Updates
Customers should follow Northflank’s published guidance: revoke and replace user-provided credentials, update affected secrets and workloads, inspect AI-provider usage and billing records, and disable public add-on access where enabled. Northflank advised users to report suspicious activity to its support team and to the relevant credential provider. Audit logs are available to all customers, including free users, according to the October 31 update.
Northflank said it would share further information as findings are confirmed. The next meaningful update would clarify the incident’s cause and scope, whether customer credentials were accessed or misused, and the status of the affected services. Until the company publishes those details, the extent of exposure and the relationship between the security incident and the service outage remain unresolved.
Key Questions
What did Northflank confirm about the breach?
Northflank disclosed a security incident and advised customers to assume environment variables may have been decrypted. It also said users had reported unauthorized use of AI API keys. The company did not publish a confirmed account of the intrusion or its scope.
What should Northflank customers do now?
Northflank advised customers to revoke and replace stored credentials, update affected secrets and workloads, review AI-provider usage and billing logs, and disable public access to add-ons where enabled. Suspicious activity should be reported to Northflank support and the relevant provider.
Were AI API keys confirmed to be stolen?
Northflank said users had reported unauthorized use of their AI API keys. Its updates did not confirm how the keys were obtained, how many customers were affected, or whether the reported use was conclusively linked to the incident.
Was Northflank’s service also disrupted?
Yes. Northflank’s status page listed networking, certificates, services, add-ons, jobs, builds, and logs and metrics as experiencing a major outage. It did not state whether the outage was caused by the security incident.
Has Northflank identified who was responsible?
No attribution was provided in the status updates. Northflank noted similarities to IP addresses in a Wiz report about attacks targeting AI credentials, but did not confirm that this incident was part of that activity.
Source: status.northflank.com
