Northflank reports security incident, tells users to rotate all secrets
Northflank, a cloud platform for running services, jobs, builds and databases, has an open security incident on its status page, listed as Identified with a Major outage. The updates run from October 30 to October 31, 2026.
Seven components show Major outage: Networking, Certificates, Services, Addons, Jobs, Builds, and Logs and Metrics. Four others are listed as Operational: the Northflank App (99.82% uptime), the Northflank API (100.0%), the Marketing Site (100.0%) and Documentation (100.0%). A summary of the page gives overall platform uptime as 99.18%.
The first update, posted Oct 30 at 1:40 PM, said Northflank was investigating and told users to rotate their environment variables. It included an internal timeline: a Wiz threat alert at 11:43, a review of the alert by Northflank engineers at 11:44, an initial network policy patch at 12:02, additional patching at 12:50, a request for Wiz CIRT support at 13:00, and more patching at 13:05.
At 1:58 PM the status moved to Identified. Northflank wrote that environment variables may have been decrypted, so all keys should be disabled or rotated. At 3:12 PM it enabled secret rotation for Postgres and MongoDB, and advised users to disable public exposure on addons and rotate secrets on workloads, secret groups and global secrets. The same update said multiple users had reported their AI keys had been used.
At 7:28 PM the company said the investigation was ongoing with no further confirmed findings, and that the guidance remained to assume all environment variables were compromised. At 11:38 PM it repeated that users had reported unauthorized use of AI API keys stored on the platform, and told them to revoke credentials with their providers, generate replacements, update secrets and workloads, and review AI provider usage and billing logs. The latest update, Oct 31 at 1:04 AM, says audit logs were enabled for all customers, including free users.
The recommended action is plain: if you use Northflank, rotate every secret and credential stored there, AI provider keys included, and check provider usage and billing for activity you do not recognise.
Key facts
- Northflank's status page shows an open security incident (Identified, Major outage) from Oct 30 to Oct 31, 2026.
- Seven components are in Major outage: Networking, Certificates, Services, Addons, Jobs, Builds, and Logs and Metrics.
- Northflank says environment variables may have been decrypted and tells users to assume all were compromised and rotate every secret.
- Users reported unauthorized use of AI API keys stored on the platform; Northflank told them to revoke keys with providers and check billing logs.
- The incident timeline starts with a Wiz threat alert at 11:43, and Wiz CIRT support was requested at 13:00.
Why it matters
Platforms like this hold the secrets that run customers' applications: database passwords, API keys, certificates. Northflank's own guidance is to treat every environment variable as compromised, which turns an outage into a credential-rotation job for every customer. The reports of AI keys being used add a direct financial angle, since provider billing is where abuse of such keys shows up.
Who it affects
Anyone running workloads on Northflank, on any plan. Audit logs were enabled for all customers, including free users. The most exposed are users who stored AI provider keys, database credentials or other secrets in environment variables, workloads, secret groups or global secrets. Users with publicly exposed addons were told to disable that exposure.
How to use it
Northflank's instructions, as posted: rotate all secrets and credentials stored on the platform; revoke credentials with the provider, generate replacements, then update secrets and workloads; disable public exposure on addons; rotate secrets on workloads, secret groups and global secrets; review AI provider usage and billing logs for unexpected activity. Secret rotation is now enabled for Postgres and MongoDB. Audit logs are on for every account.
How solid is it
The source is Northflank's own status page, so the incident, the outages and the guidance are first-party. The decryption of environment variables is stated as a possibility ("may have been decrypted"), not a confirmed finding. The AI key abuse is reported by users and relayed in Northflank's updates, not presented as a verified finding. The page itself calls this a security incident and does not use the word breach. The text available for this account includes a summary of the full page, not only its verbatim text.
Risks and caveats
The cause or attack vector is not stated. No attacker is named, and no count of affected customers or abused AI keys is given. Which AI providers were hit and any dollar amounts are not given. No estimated time of restoration for the major outages is given. The time zone of the incident timeline (11:43 and so on) versus the update stamps (1:40 PM) is not clear from the fetched text. The incident is still open, so the picture may change.