Northflank: security incident, customers told to assume all environment variables were decrypted
Severity: critical · Patch status: partial · Since 2026-10-30
Northflank, a cloud deployment platform, posted a security incident on 30 October 2026 after a Wiz threat alert fired at 11:43 UTC. It patched network policy within hours. It first told customers to rotate environment variables, then to assume that every stored environment variable had been decrypted and to rotate or disable keys. Later that evening users reported unauthorised use of AI API keys supplied to the platform. Northflank said these reports may be consistent with the broader pattern in Wiz's Black October report and cited similar IP addresses. It has not published a root cause. Its most recent investigation update (30 October, 7:28 PM UTC) said the investigation was ongoing with no further confirmed findings. Customers should rotate all secrets (workloads, secret groups, global secrets), revoke AI provider keys at the issuer, and disable public addon access. Database secret rotation shipped on 30 October (Postgres, MongoDB) and 31 October (MySQL, Redis), and audit logs were enabled for all customers. Wiz counts Northflank among at least nine AI developer platforms with October 2026 incidents.
What to do
- Rotate every secret and credential stored in Northflank: workloads, secret groups and global secrets
- Revoke AI provider keys at the issuing provider, create replacements and update workloads
- Check AI provider usage and billing for unexpected activity and report it to the provider and Northflank
- Disable public access to addons where enabled (the notices name Postgres, MongoDB, MySQL and Redis), then use the new secret rotation features
- Review audit logs; Northflank enabled them for all customers, including free accounts, on 31 October
Sources
All live incidents on Threat Watch
