--- title: "Northflank environment-variable security incident" description: "Northflank urged customers to rotate environment-variable secrets after a security incident and reports of unauthorized AI-key use." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-31" canonical_url: "https://www.ally.security/incidents/northflank-environment-variable-security-incident-2026" markdown_url: "https://www.ally.security/incidents/northflank-environment-variable-security-incident-2026.md" stix_url: "https://www.ally.security/incidents/northflank-environment-variable-security-incident-2026/stix.json" --- # Northflank environment-variable security incident Urgent rotation guidance covers all keys, while the exact extent of compromise remains under investigation. Last modified Oct 31, 2026 · 1 source ## Summary - **Environment:** Northflank hosting platform and customer environment variables - **Operational impact:** Several platform components marked with major outages; app and API operational at review - **Financial impact:** No confirmed incident cost quantified ## What happened [Northflank](https://northflank.com/) investigated a security incident after a [Wiz](https://www.wiz.io/) alert at 11:43 UTC on October 30, 2026. It patched network policies and warned customers to disable and rotate keys. [1](#source-1) ## Impact Northflank told customers to assume environment variables had been decrypted. This precaution does not prove every secret was stolen. It subsequently relayed customer reports of unauthorized AI API-key use. Several platform components were marked with major outages at review; that status does not establish every workload was unavailable. [1](#source-1) ## Timeline ### October 30, 2026 — Alert, patches and urgent rotation warning The [status updates](https://status.northflank.com/) record the alert, network-policy patches and customer warnings. [1](#source-1) ### October 31, 2026 — Audit logs and more secret-rotation tools opened Northflank made audit logs available to all users and enabled MySQL and Redis password rotation after the previous day’s PostgreSQL and MongoDB changes. [1](#source-1) ### October 31, 2026 — Briefing updated This briefing was last reviewed and updated on October 31, 2026. ## Threat Group & Attack Vector The precise entry path, actor and affected-user total remain unresolved. Similarities to indicators in other reporting do not establish a common attacker. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response Customers were advised to revoke keys with their issuers, replace secrets across workloads and secret groups, and review usage and billing. Northflank also recommended disabling public exposure of addons. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Northflank Status — Security incident official · Northflank · Oct 30, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Northflank environment-variable security incident: Audit logs and additional database-secret rotation made available 2. **Resulted In · 100% confidence · current** Northflank environment-variable security incident: Northflank said IP addresses resembled indicators in Wiz reporting, but its notice did not establish an attacker identity, a completed root-cause finding or a confirmed total of affected users. 3. **Resulted In · 100% confidence · current** Northflank environment-variable security incident: Northflank advised disabling public exposure of addons and rotating secrets in workloads, secret groups and global secrets. 4. **Disclosed At · 100% confidence · current** Northflank environment-variable security incident: 2026-10-30 5. **Resulted In · 100% confidence · current** Northflank environment-variable security incident: Northflank said Wiz alerted it at 11:43 UTC on October 30; investigation began at 11:44 and network-policy patches followed at 12:02, 12:50 and 13:05 UTC. 6. **Resulted In · 100% confidence · current** Northflank environment-variable security incident: Northflank enabled PostgreSQL and MongoDB credential rotation for all customers on October 30; it made audit logs available to all users on October 31 and added MySQL and Redis rotation that day. 7. **Affected Organization · 100% confidence · current** Northflank environment-variable security incident: Northflank 8. **Occurred At · 100% confidence · current** Wiz alert, patches and urgent key-rotation warning: 2026-10-30 9. **Resulted In · 100% confidence · current** Northflank environment-variable security incident: Wiz alert, patches and urgent key-rotation warning 10. **Resulted In · 100% confidence · current** Northflank environment-variable security incident: At 13:58 UTC on October 30, Northflank advised customers to assume environment variables had been decrypted and to disable and rotate all keys. This was precautionary guidance, not confirmation that every customer secret was stolen. 11. **Resulted In · 100% confidence · current** Northflank environment-variable security incident: At retrieval on October 31, the status page marked seven platform components with major outages while the application and API were operational. This does not establish that every customer workload was unavailable. 12. **Occurred At · 100% confidence · current** Audit logs and additional database-secret rotation made available: 2026-10-31 13. **Resulted In · 100% confidence · current** Northflank environment-variable security incident: Northflank reported multiple customer accounts of unauthorized use of AI API keys and advised revocation at the issuing provider, replacement and usage/billing review. 14. **Discovered At · 100% confidence · current** Northflank environment-variable security incident: 2026-10-30