Andromeda: some company and customer credentials exposed in 'industry-wide attack'
Severity: medium · Patch status: unknown · Since 2026-10-20
Andromeda, an AI infrastructure provider, reports unauthorized access to credentials in its environment, exposing some of its own credentials and some belonging to a limited number of customer accounts. Activity is believed to have begun around Oct 9 as part of what the company calls an industry-wide attack; Andromeda found it on Oct 13, disabled the compromised accounts, rotated all affected keys and hardened its infrastructure, and published its notice on Oct 20 with third-party forensics ongoing. It says customer models, datasets and training data inside its perimeter were not accessed and that nothing further has been seen since Oct 13. Root cause and actor are unnamed, the exact credential types are not described, and no downstream key abuse is confirmed. Wiz counts it among at least nine AI developer platforms hit in October 2026.
What to do
- If Andromeda contacted you, rotate any keys or credentials it names and review usage logs
- Rotate any third-party keys stored on or reachable from Andromeda if you are unsure of your exposure
- Contact your Andromeda representative with questions or suspicious activity
Sources
All live incidents on Threat Watch
