October 30, 2026: Northflank, a hosting platform for developers, said a breach had led to unauthorised use of customers' AI API keys. The company told customers to assume all environment variables have been decrypted and to rotate every key and secret. The attackers and the entry point have not been disclosed. The catalog entry records the company's statements.
What happened
Northflank says it received a threat alert from the security firm Wiz at 11:43 UTC on October 30. Engineers reviewed it within a minute. The company then applied a network policy patch, followed by further patches at 12:50 and 13:05 UTC, and asked Wiz's incident response team for help. Its updates say customers have reported unauthorised use of the AI API keys supplied to the platform.
What the company told customers
- "Assume all environment variables have been decrypted. Disable/rotate all keys."
- Rotate all credentials and secrets, including those in workloads, secret groups and global secrets.
- Review AI provider usage and billing logs for unexpected activity.
- Report suspicious usage to Northflank and to the AI providers.
- Disable public access to add-ons where it is enabled.
What the platform has done
Northflank says it has enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis, and turned on audit logs for all customers, including free accounts.
Verified and unverified
- Confirmed by the company: the breach; unauthorised use of customers' AI API keys; the instruction to rotate all keys and secrets; and the credential-rotation and audit-log steps above.
- Unverified: how many customers were affected, which the company has not stated; how the attackers got in; who they are; whether credentials other than AI API keys were taken or misused; and whether customer data was accessed. The company's updates do not mention customer data.
- Linked by Wiz, not confirmed: Wiz connects the customer reports to its "Black October" research on attacks against AI developer platforms. Wiz has not confirmed that the incidents share the same attackers.
Who may be affected
- Northflank customers who stored AI provider API keys on the platform.
- Anyone whose environment variables or secrets were kept in Northflank, because the company says to assume they were decrypted.
What to do
- Rotate every AI API key stored in Northflank, starting with keys that have billing access.
- Rotate the other secrets in your environment variables, secret groups and database credentials.
- Review usage and billing logs at each AI provider for requests you did not make, and report anything suspicious to that provider.
- Turn off public access to any add-on you do not need.
- Check your Northflank audit logs for actions you do not recognise.
Why it matters
An AI API key can run requests under your account, so a stolen key can produce unexpected charges even if no other data is taken. Rotating keys is the fastest way to cut off that access, and it should be done before any investigation finishes.
Sources and sourcing note
Sourcing note: this account comes from Northflank's own updates as reported by BleepingComputer, which said Northflank had not answered its questions when the article was published. We have not reviewed Northflank's status page in full. This post will be updated when Northflank publishes a root-cause report.