Northflank breach: customers told to treat all env variables as exposed

Victoria Shinder31 October 2026, 10:242 min read

Northflank, a platform for deploying containers, databases and jobs, has been running a security incident since 30 October. Its public status page lists the platform's networking, certificates, services, addons, jobs, builds and logs as in major outage, and gives one instruction above all others: assume all environment variables have been decrypted, and rotate every secret and credential.

The timeline on the page starts with a threat alert from the security company Wiz at 11:43 UTC, reviewed by Northflank engineers a minute later. A first network policy patch went out at 12:02 UTC, more patches at 12:50 and 13:05, and Wiz's incident response team was brought in at 13:00. Northflank posted the rotation advice at 13:40 and 13:58 UTC, and at 15:12 UTC said that secret rotation for Postgres and MongoDB addons had been enabled for all users, adding that "multiple users are confirming that their AI keys have been used". It also recommends turning off public exposure on addons.

At 23:38 UTC the company said users had reported unauthorised use of AI API keys supplied to the platform and asked them to revoke those keys with the issuing providers, check AI usage and billing logs, and report anything suspicious. It said the reports "may be consistent" with a wider campaign against AI credentials described in a Wiz report. On 31 October at 01:04 UTC audit logs were switched on for all customers, including free accounts. At 19:28 UTC on 30 October the company said it had no further confirmed findings; the page does not say how attackers got in.

What it means

For Northflank customers the list is not optional: secrets on workloads, secret groups and global secrets all count, and revocation has to happen at the issuer, because replacing a value inside Northflank does not invalidate a key that was already copied. AI provider keys are the first ones reported abused, which makes billing dashboards the quickest place to see whether a key was used.