Northflank: platform breach, customers told to assume all environment variables were decrypted
Severity: critical · Patch status: partial · Since 2026-10-30
Northflank, a cloud deployment platform, declared a security incident on Oct 30 after a Wiz threat alert fired at 11:43 UTC. It patched network policy within hours and told customers to rotate environment variables, then to assume every stored environment variable may have been decrypted. Multiple users reported their AI provider API keys being used without authorization, and by evening Northflank tied the activity to the pattern in Wiz's Black October report. The full scope is not confirmed and the investigation is ongoing. Customers should rotate all secrets (workloads, secret groups, global secrets), revoke AI provider keys at the issuer, and disable public addon access; database secret rotation shipped over Oct 30-31 and audit logs were enabled for all users. Wiz counts it among at least nine AI developer platforms hit in October 2026.
What to do
- Rotate every secret and credential stored in Northflank: workloads, secret groups and global secrets
- Revoke AI provider keys at the issuing provider, create replacements and update workloads
- Check AI provider usage and billing for unexpected activity and report it to the provider and Northflank
- Disable public access on addons (Postgres, MongoDB, MySQL, Redis) and use the new secret rotation features
- Turn on and review audit logs (now enabled for all accounts)
Sources
All live incidents on Threat Watch
