Northflank security incident: the PaaS tells every customer to assume their environment variables were decrypted and rotate all secrets; users report stolen AI API keys already being used
Cloud deployment platform Northflank opened a security incident on its status page on Oct 30 (first post 9:40 AM ET), after a Wiz threat alert at 7:43 AM ET. Its own timeline lists a first network-policy patch 19 minutes later, more patches through the morning, and a request for help from Wiz's incident response team.
- Guidance (9:58 AM ET): "Assume all environment variables have been decrypted. Disable/rotate all keys." That covers secrets on workloads, secret groups and global secrets.
- Addons: Postgres and MongoDB secret rotation is now enabled for all users, and Northflank recommends turning off public exposure on addons.
- Abuse (7:38 PM ET): "Users have reported unauthorised use of AI API keys supplied to the Northflank platform." Northflank says this may fit the wider campaign against AI credentials and points to Wiz's Black October report.
- 9:04 PM ET: audit logs enabled for all customers, including free users.
Not yet known: the root cause, which customers or regions are affected, and whether bring-your-own-cloud deployments are in scope. At 3:28 PM ET Northflank said it had "no further confirmed findings to share."
Do now: revoke and reissue every secret at the issuing provider (AI keys and payment keys first), check provider usage and billing since Oct 29, then update the values in Northflank. Railway had a similar platform breach on Oct 21.
Sources: Northflank status: Security incident (updates Oct 30, 1:40 PM UTC to Oct 31, 1:04 AM UTC)