On 30 October 2026, Northflank, a cloud platform, told its customers to assume that every environment variable stored on the platform was decrypted. Customers then reported that AI API keys they had supplied to the platform were being used without permission. If you run workloads there, rotate every stored secret now, starting with the keys that reach outside Northflank.
What Northflank’s Status Page Says
Northflank’s status page shows one security incident, currently marked Identified. Its posted timeline starts with a Wiz threat alert at 11:43 UTC on 30 October, followed by a network policy patch at 12:02 UTC. Two more patches and a request for Wiz’s incident response team (CIRT) followed, the last at 13:05 UTC.
As of the page we read on 1 November, the updates give no entry point and no count of affected customers. They do give a clear order of events, shown below in UTC.
- 30 Oct 13:40Rotate nowCustomers are told to rotate environment variables immediately.
- 30 Oct 13:58Assume decryptionStatus moves to Identified: assume all environment variables have been decrypted.
- 30 Oct 15:12First database rotationSecret rotation is enabled for Postgres and MongoDB, and multiple users confirm their AI keys were used.
- 30 Oct 23:38AI key abuseNorthflank says users reported unauthorised use of AI API keys supplied to the platform.
- 31 Oct 01:04Audit logsAudit logs are enabled for all customers, including free users.
- 31 Oct 13:34MySQL and RedisSecret rotation becomes available for both.
- 31 Oct 22:32MinIOSecret rotation becomes available for MinIO add-ons.
- 31 Oct 23:31RabbitMQRotation becomes available for RabbitMQ add-ons, and Northflank repeats that all secrets should be rotated.
What to Rotate and in What Order
Northflank’s guidance covers secrets on workloads, secret groups and global secrets, and it asks customers to disable public access to add-ons where enabled. The order below is ours: keys that can spend money or reach other systems work from anywhere, so they go first.
- Replace outside keys firstRevoke AI provider, cloud and payment keys at the issuer, create replacements, then update the secrets and workloads in Northflank, as the status page advises.
- Rotate what Northflank now rotates for youUse the rotation Northflank has enabled for Postgres, MongoDB, MySQL, Redis, MinIO and RabbitMQ, then update every secret group and global secret.
- Close public add-on accessDisable public exposure on add-ons if you enabled it.
- Read the usage logsReview AI provider usage and billing logs for unexpected calls, and report suspicious usage to Northflank support and the provider.
- Turn on audit reviewAudit logs are now on for every customer, including free accounts.
The status page does not say when access began, so we suggest widening the log review window beyond 30 October. That advice is ours, not Northflank’s.
How This Fits the October Platform Breaches
Northflank says its AI key reports may be consistent with the broader pattern in Wiz’s “Black October” report, and that similar IP addresses are contained in that article. Wiz, writing on 30 October, counts at least nine AI developer platforms that disclosed incidents during October. It lists Railway on 20 October and Northflank on 30 October.
Wiz says all public reports describe targeted exploitation that hunts stored environment variables, especially those granting AI access. It also says it has no evidence linking the IP addresses in its indicator table directly to the attacks in that post. Wiz describes two enterprise cases of key abuse that it attributes to one of these vendor breaches without naming the vendor, so do not read them as Northflank customers.
The same risk shaped the Railway incident: a trusted service held its customers’ secrets. Our Railway breach rotation checklist and the Railway incident page cover it. Whatever the entry point turns out to be, this is a supply chain attack risk, and a cloud security question about where secrets live. Brandefense Blackhole recorded seven Telegram posts naming Northflank between 30 October and 1 November.