2026 Northflank — hosting platform breach led to unauthorised use of customers' AI API keys; customers told to rotate all secrets
Data compromised
AI API keys supplied to the platform, which customers reported as used without authorisation. The company tells customers to treat all environment variables and stored secrets as decrypted. It has not said whether other credentials were taken. Customer data is not mentioned, and the number of affected customers is not stated.
Technical writeup
Credential rotation has been enabled for PostgreSQL, MongoDB, MySQL and Redis. Audit logs are enabled for all customers, including free accounts. Customers are asked to disable public access to add-ons where it is enabled.
Root cause
Northflank says it received a threat alert from Wiz at 11:43 UTC on October 30 and applied network policy patches. It told customers to assume environment variables were decrypted and to rotate all keys. The entry point and the attackers have not been disclosed. Wiz links customer reports to its "Black October" research on attacks against AI developer platforms but has not confirmed the same attackers.