TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Northflank’s October 30 security incident led the company to tell customers to treat all environment variables as compromised and rotate secrets and credentials. The company later enabled audit logs and secret rotation for several database and MinIO add-ons, while the scope and cause of the incident remained unconfirmed in its status updates.
Northflank urged customers to assume that all environment variables stored on its platform had been decrypted after a security incident, and to rotate their secrets and credentials. The company’s status page also reported customer accounts of unauthorized use of AI API keys, while listing networking, certificates, services, add-ons, jobs, builds, and logs and metrics as experiencing major outages.
Northflank’s status page showed the incident as identified on October 30, 2026, at 1:58 p.m. UTC. Earlier, the company had advised customers to rotate environment variables. Its timeline said engineers reviewed a Wiz threat alert at 11:44 a.m. UTC, deployed an initial network-policy patch at 12:02 p.m., and applied additional patches later. Northflank said it requested support from Wiz’s Computer Incident Response Team at 1:00 p.m.
At 3:12 p.m. UTC, Northflank said customers should assume their environment variables had been decrypted and start rotating them. It specified secrets on workloads, in secret groups, and in global secrets, and recommended disabling public exposure on add-ons where enabled. In a later update, the company said its investigation was ongoing and it had no further confirmed findings to share.
Northflank’s October 30 update said users had reported unauthorized use of AI API keys supplied to the platform. The company advised affected customers to revoke credentials with their issuing providers, create replacements, update secrets and workloads, and review provider usage and billing records. On October 31, it said audit logs had been enabled for all customers, including free users, and that secret rotation was available for Postgres, MongoDB, MySQL, Redis, and MinIO add-ons in separate updates.
Credential Risks for Northflank Users
The incident matters because environment variables can contain credentials used by applications, including database passwords and third-party API keys. If those values were exposed, unauthorized parties could potentially use them to access connected services or run up charges. Northflank’s advice to rotate secrets reflects that risk; the status page does not establish that every customer’s credentials were accessed or misused.
Reports of AI API key use are especially relevant to customers whose workloads connect to paid AI services. Northflank asked users to check provider billing and usage logs, which can help identify activity they do not recognize. The company’s status page did not quantify affected customers, confirmed unauthorized requests, or financial losses.
The listed outages also indicate broad disruption across platform functions during the incident. Northflank marked its app and API operational in the supplied status information, but listed multiple underlying services as facing major outages. The page did not explain whether every outage was directly caused by the security response or by the incident itself.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Performance Keyboard – Clicky
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
As an affiliate, we earn on qualifying purchases.
Incident Response and Secret Rotation
The status-page timeline places the response on October 30. Northflank said it received a Wiz threat alert at 11:43 a.m. UTC, reviewed it a minute later, and began deploying network-policy changes at 12:02 p.m. Further patching followed, and the company sought Wiz CIRT support. The timeline records response actions, but does not describe the vulnerability, suspected attacker, or how access may have occurred.
Northflank’s guidance became more specific as the updates progressed. It first told customers to rotate environment variables, then said to treat all such values as decrypted and named workloads, secret groups, and global secrets as places to check. It also advised disabling public exposure for add-ons where enabled. The later addition of audit logs for all customers gives users a way to review activity, though the status update did not specify what events those logs capture or how far back they extend.
By October 31, the company had announced secret-rotation availability for several managed add-on types. Its 10:32 p.m. UTC update said MinIO rotation was available to all customers; earlier updates covered MySQL and Redis, as well as Postgres and MongoDB. Northflank repeatedly told customers who had not rotated secrets to do so.
“Assume all environment variables have been decrypted. Disable/rotate all keys.”
— Northflank status page, October 30, 2026, 1:58 p.m. UTC
Scope and Cause Still Undetermined
The supplied status updates do not identify the cause of the breach, the method used to gain access, or who was responsible. Northflank’s warning that customers should assume environment variables were decrypted is precautionary guidance; it does not, by itself, confirm that every stored secret was accessed. The company did not state how many customers or workloads may be affected.
Reports of AI key use came from users, according to Northflank. The status page does not provide independently verified counts, name affected providers, or confirm whether the activity resulted from this incident. Northflank said the reports might be consistent with a broader pattern of attacks targeting AI credentials and referred readers to a Wiz report; it did not present that connection as established attribution.
The status information also does not give a complete account of service restoration, the duration of each major outage, or whether all customers have completed credential rotation. The latest supplied update announces MinIO rotation, but provides no final incident resolution or investigation findings.
Customer Actions and Further Updates
Northflank’s published guidance is for customers to rotate all secrets and credentials stored on the platform, including workload variables, secret groups, global secrets, and credentials associated with add-ons. Customers should revoke the old credentials with the issuing services, replace them, update affected workloads, and disable public add-on access where it is enabled.
The company also advised customers to inspect AI provider usage and billing logs and report suspicious activity to Northflank support and the relevant provider. Its status page said it would share further updates as information was confirmed. Readers should look to Northflank’s incident updates for findings about the scope, cause, affected accounts, and service recovery; those details were not available in the supplied material.
Key Questions
What happened at Northflank?
Northflank reported a security incident on October 30, 2026, and told customers to assume environment variables had been decrypted and rotate their credentials. The status page also recorded reports of unauthorized use of AI API keys.
What should Northflank customers do?
Northflank advised customers to revoke and replace stored credentials, update affected secrets and workloads, and review provider usage and billing logs. It also recommended disabling public access to add-ons where enabled.
Has Northflank confirmed that all customer secrets were stolen?
No. The company instructed customers to treat environment variables as compromised, but its supplied updates do not confirm that every secret was accessed or identify the number of affected customers.
Were AI API keys used without authorization?
Northflank said users had reported unauthorized use of AI API keys supplied to the platform. The status updates do not give a confirmed count or establish the full scope or cause of the reported activity.
Which Northflank services were listed as disrupted?
The status information listed networking, certificates, services, add-ons, jobs, builds, and logs and metrics as experiencing major outages. It listed the Northflank app and API as operational in the supplied report.
Source: status.northflank.com
