Northflank tells every customer to rotate secrets after a breach

Northflank tells every customer to rotate secrets after a breach

30 October 2026: Northflank, a platform that runs customers' containers, databases, jobs and builds, has told all of its users to assume their environment variables have been decrypted and to rotate every secret and credential they store with it. Within hours, users reported that AI API keys held on the platform were being used without their consent, and Northflank's status page still showed major outages across networking, certificates, services, addons, jobs, builds and logs on the morning of 31 October.

Not yet independently verified. This rests on Northflank's own status page. Northflank has not yet said how the attacker got in or how many customers were affected, and we have not read an independent account of the incident. We will update this when it can be confirmed, and remove this note.

Eighty minutes from alert to "assume decrypted"

Northflank's own timeline starts with a threat alert from the security firm Wiz at 11:43 UTC on 30 October. Engineers reviewed it a minute later, deployed a first network policy patch at 12:02 and further patches at 12:50 and 13:05, and asked Wiz's incident response team for help at 13:00. At 13:40 the status page told users to rotate environment variables immediately, and at 13:58 it went further: "Assume all environment variables have been decrypted. Disable/rotate all keys."

At 15:12 Northflank enabled secret rotation for Postgres and MongoDB addons for all users and listed the three places secrets live on the platform: secrets set on workloads, secret groups and global secrets. By then, it said, multiple users were confirming that their AI keys had been used. A 19:28 update said the investigation had no further confirmed findings and the guidance was unchanged.

AI keys used, and a link to a wider campaign

At 23:38 Northflank reported unauthorised use of AI API keys supplied to the platform and said the reports "may be consistent with the broader pattern of attacks targeting AI credentials", pointing to IP addresses listed in Wiz's "Black October" report. At 01:04 on 31 October it switched on audit logs for every customer, free accounts included. Northflank has not said how the attacker reached the secrets, whether data in databases was read, or how many accounts are affected.

The rotation list for teams on Northflank

Northflank's guidance amounts to a full rotation rather than a selective one:

• revoke each credential with the provider that issued it, generate a replacement, and update the secret and every workload that uses it;
• cover workload secrets, secret groups and global secrets, and rotate database credentials with the new Postgres and MongoDB rotation;
• disable public access on any addon where it was enabled;
• check AI provider usage and billing logs for activity since 30 October, and report anything unexpected to Northflank and to the provider.

Keys that were rotated before the AI misuse reports may still have been used in the hours before; billing logs show when. The audit logs now enabled on every account are the first place to look for actions taken inside the platform itself.

Related on TrustList:

• Heroku-22 reaches end of life on 30 April 2027; move apps now

Sources

• Northflank status: Security incident (updates from 30 October, 13:40 UTC, to 31 October, 01:04 UTC), 31 October 2026