Northflank has told customers to assume that environment variables stored on its cloud platform were compromised and to rotate every secret after a security incident. In a status update at 01:04 UTC on October 31, the company said audit logs are now enabled for all customers, including free users; it also said customers had reported unauthorized use of AI API keys supplied to the platform.
The incident was first listed on Northflank’s status page on October 30. The company’s timeline begins with a threat alert from Wiz at 11:43 UTC, followed by an internal review and network policy patches. Northflank requested support from Wiz’s incident response team at 13:00 UTC and began telling customers to rotate credentials at 13:40 UTC.
What Northflank has confirmed
Northflank’s guidance covers secrets stored in workloads, secret groups and global secrets. The company said all users should assume those environment variables were decrypted, and it enabled secret rotation for PostgreSQL and MongoDB services. It also advised customers to disable public access to add-ons where that option is enabled.
Environment variables often contain database passwords, cloud credentials and API tokens that applications need to connect to other services. If those values are exposed, replacing only a key that shows suspicious activity may leave other linked accounts at risk. Northflank’s instruction therefore applies to all secrets stored on the platform, not just the AI keys mentioned in customer reports.
In an update at 23:38 UTC on October 30, Northflank said customers had reported unauthorized use of AI API keys connected to the platform. The company urged users to revoke credentials with their issuing providers, generate replacements, update affected secrets and workloads, and check AI-provider usage and billing logs for unexpected activity.
At the time of writing, Northflank’s status page continued to list major outages across seven platform components, including networking, certificates, services, add-ons, jobs, builds, and logs and metrics. Northflank has not disclosed how many customers were affected or explained how the attacker gained access. Its investigation remains ongoing, and the company says it has no further confirmed findings to share.
What customers should do
Customers should rotate every credential stored in Northflank, not only AI keys that show suspicious activity. Revoke the old credentials at the service that issued them, create replacements, and update the corresponding environment variables and workloads. Review provider usage and billing records for activity that was not authorized, and disable public exposure on add-ons that do not need it.
An exposed AI key can also be abused to generate unexpected usage charges; Google API key exposure is one example of that risk.
Northflank’s October 31 update says audit logs are available to all customers, including those on free plans. Customers should review those logs as part of their investigation and contact Northflank support if they find unexplained activity.
The company has not said whether attackers copied every environment variable or accessed customer application data. Its public updates also do not identify an entry point or provide a final count of affected customers. Northflank continues to investigate and says it will share further findings when they are confirmed.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
