Summary
- Environment: Northflank hosting platform and customer environment variables
- Operational impact: Several platform components marked with major outages; app and API operational at review
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed October 31, 2026; updated as evidence emerges.
What happened
Northflank investigated a security incident after a Wiz alert at 11:43 UTC on October 30, 2026. It patched network policies and warned customers to disable and rotate keys. [1]
Impact
Northflank told customers to assume environment variables had been decrypted. This precaution does not prove every secret was stolen. It subsequently relayed customer reports of unauthorized AI API-key use. Several platform components were marked with major outages at review; that status does not establish every workload was unavailable. [1]
Timeline
Alert, patches and urgent rotation warning
The status updates record the alert, network-policy patches and customer warnings.
[1]Audit logs and more secret-rotation tools opened
Northflank made audit logs available to all users and enabled MySQL and Redis password rotation after the previous day’s PostgreSQL and MongoDB changes.
[1]Briefing updated
This briefing was last reviewed and updated on October 31, 2026.
Threat Group & Attack Vector
The precise entry path, actor and affected-user total remain unresolved. Similarities to indicators in other reporting do not establish a common attacker. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Customers were advised to revoke keys with their issuers, replace secrets across workloads and secret groups, and review usage and billing. Northflank also recommended disabling public exposure of addons. [1]