Northflank breach: assume every secret is compromised
Northflank told customers on 30 October to rotate every environment variable after a Wiz alert, with users already reporting stolen AI keys in active use.
Northflank, a cloud platform for running backend apps and containers, disclosed a security incident on 30 October after a threat alert from security vendor Wiz at 11:43 UTC. Within fifteen minutes its status page told every customer to assume all environment variables had been decrypted and to rotate every secret, including those in workloads, secret groups and global secrets.
By the afternoon Northflank had forced secret rotation on its Postgres and MongoDB add-ons and was telling users to disable public access on any add-on where it was enabled. Multiple customers confirmed their AI API keys were already being used without authorisation. Northflank has not disclosed a root cause, how the variables were accessed, or how long the exposure lasted. It enabled audit logs for every customer, including free-tier accounts, in its latest update.
Why it matters: if you run anything on Northflank, rotate every credential now, not just the ones you suspect, and check your AI provider’s billing and usage logs for activity you didn’t generate. Wiz’s own research names this as one of at least nine AI developer platforms breached this month through stolen environment variables, so the same check is worth running wherever you store AI keys, not just here.
The caveat: Northflank says its investigation is ongoing and has “no further confirmed findings to share” beyond the guidance above.