{ "type": "bundle", "id": "bundle--b3821368-1be6-518a-8e9f-a77ab501ae65", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--5b4ff7fc-a72a-547b-8e04-4562b562d148", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "org:609e8cd0-94ce-4f14-bf49-1d1b658166af", "name": "Northflank", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--65ef2a3f-8c9a-5e29-8ceb-82b547a7fa67", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "brh:1a915bde-7ef0-42be-91d6-7dd466784fd1", "name": "Northflank environment-variable security incident" }, { "type": "incident", "spec_version": "2.1", "id": "incident--dffcd63b-f517-530a-8010-4d5fc0a26318", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "inc:8cfa7b4e-b992-474c-989c-ced3992d2804", "name": "Northflank environment-variable security incident" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c1f6988-db39-5257-89fb-1628ff935b28", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:8d73cf3f-4dc1-41d1-b398-6d49629602d9", "relationship_type": "resulted-in", "source_ref": "incident--dffcd63b-f517-530a-8010-4d5fc0a26318", "target_ref": "x-ally-event--4fda60e5-124a-5459-8948-e97d60791e88", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:5ddac346-5e2e-4bb0-81f9-d0847c60c92d", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--37c91c25-77f3-5f24-8597-1b3d411c4d14", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:029b9a59-c78e-406b-9381-a77b2d5b832b", "relationship_type": "resulted-in", "source_ref": "incident--dffcd63b-f517-530a-8010-4d5fc0a26318", "target_ref": "x-ally-event--d3698075-57be-5377-8c4f-aa9041bfa909", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:b0de9c1b-fe58-43d3-8d00-8d9c0068ebec", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e980a55f-28d0-54cf-8fa8-5e61b9dc8983", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:7f7f8e87-d0ec-46bf-b056-1c8853aa6d99", "relationship_type": "affected-organization", "source_ref": "incident--dffcd63b-f517-530a-8010-4d5fc0a26318", "target_ref": "identity--5b4ff7fc-a72a-547b-8e04-4562b562d148", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:a08f3ce7-5d52-4969-8ef6-2662c9f2dec4", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--0360dee9-cdba-5ef7-8eb1-7c51102d5f02", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:dda62246-7988-4a62-90a4-e086282b8bc9", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:9681d1a5-ea20-4d04-8d5d-2dfa623c7404", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Northflank reported multiple customer accounts of unauthorized use of AI API keys and advised revocation at the issuing provider, replacement and usage/billing review." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--25a234ae-2199-5710-81dd-3f3be00e9f67", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:82cb3b54-bb4f-47e1-9208-09bd5a9d9b1e", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:49756c35-cfa9-448e-aebb-1e96d5e76841", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-30" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--30adaed3-64d8-5476-8d29-09d953bbd310", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:20b31367-6ab7-4542-917f-26f9d821b0ed", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:c43549d4-f2ef-4fb7-b0ba-854c78efe817", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-30" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--46850ff3-75b9-55f2-823e-3ea75454e186", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:ecf4e49f-ff9e-4bf6-8e32-37fd239fc292", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:55f97477-baae-4742-91b2-872b27b76421", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-30" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--6016b4d9-348b-5eee-85b7-68d93f2a2b8d", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:c3e462e1-1a72-478c-af8c-2d311daa3aef", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:6c4bed7d-bd43-4ac7-8caf-79c50c99afee", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "At retrieval on October 31, the status page marked seven platform components with major outages while the application and API were operational. This does not establish that every customer workload was unavailable." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--6a5b2b81-de7b-5f4d-82e5-092dffd93501", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:4500daa2-d976-4de7-be43-d3a0b98dc459", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:44705e47-a5b1-4982-9d3e-d58a907fe070", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Northflank enabled PostgreSQL and MongoDB credential rotation for all customers on October 30; it made audit logs available to all users on October 31 and added MySQL and Redis rotation that day." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--6d2bf1b0-64e9-517a-8e1e-c45a7941eebe", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:150f38e8-963d-4430-b2ed-5abad3f83d30", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:f4b98b6f-e741-4658-b9aa-3b98fe9e3f2a", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Northflank said IP addresses resembled indicators in Wiz reporting, but its notice did not establish an attacker identity, a completed root-cause finding or a confirmed total of affected users." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--71363b9d-31b8-5b6d-88c4-41a4377aae79", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:a0b1534c-9154-44bf-8ac6-f2e53f169ec9", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:edefe40b-10aa-43ab-8166-67c997f0fa3d", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "At 13:58 UTC on October 30, Northflank advised customers to assume environment variables had been decrypted and to disable and rotate all keys. This was precautionary guidance, not confirmation that every customer secret was stolen." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--8b7bab1b-4e0a-5af8-8b6d-2dfe40047a4c", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:28443d86-8a63-47fe-b317-fc6a3f15c1fc", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:41e65efc-5a3b-49c1-9336-73eb9f014fc4", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Northflank said Wiz alerted it at 11:43 UTC on October 30; investigation began at 11:44 and network-policy patches followed at 12:02, 12:50 and 13:05 UTC." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--b6cb0e9c-eb65-509a-84dc-6493df9b840e", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:16b80419-13d9-47ee-9337-a76c5190be0d", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:c6d30ae1-996a-4c09-b69a-6ab76cf8106c", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Northflank advised disabling public exposure of addons and rotating secrets in workloads, secret groups and global secrets." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--de2fad27-aaed-5fbb-8a87-95a385268d33", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "clm:d8ed1912-ab54-45f9-9f75-7da50380a5d4", "confidence": 100, "external_references": [ { "source_name": "Northflank", "url": "https://status.northflank.com/", "external_id": "cit:e90bb82a-6436-42a3-9649-1fe7da69b86d", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:de1a0b8cebfa86591b8b97baa8c46518a8a7f80f67444e4b5624dc26f2dcf8f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-31" } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--4fda60e5-124a-5459-8948-e97d60791e88", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "evt:d537ceb9-c194-4e23-885d-53311d2c7019", "name": "Wiz alert, patches and urgent key-rotation warning" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--d3698075-57be-5377-8c4f-aa9041bfa909", "created": "2026-10-31T14:10:17.070783+00:00", "modified": "2026-10-31T14:10:17.070783+00:00", "x_ally_original_id": "evt:eac2eaab-31de-4210-a7bb-dd94ab781507", "name": "Audit logs and additional database-secret rotation made available" } ] }