Northflank Security Breach Leads to Unauthorized AI API Key Usage, Customers Urged to Rotate Secrets

Northflank urged customers to rotate all platform secrets after reports of unauthorized AI API key use, warning that environment variables across workloads, secret groups, and global settings may have been exposed.

Northflank is investigating a security incident involving reported misuse of AI keys but has not confirmed the entry point, identified an attacker, or disclosed affected customers. Its credential rotation warning remains precautionary, not confirmation of widespread theft.

Northflank’s published timeline begins with a Wiz threat alert at 11:43 UTC on October 30, 2026. Engineers reviewed the alert one minute later and deployed an initial network policy patch at 12:02 UTC.

Further patches followed at 12:50 and 13:05 UTC, and the team requested support from the Wiz incident response team at 13:00 UTC.

The timeline does not explain what those patches fixed. A network policy change alone does not establish how attackers entered the platform or reached customer secrets.

Northflank Security Breach

Northflank subsequently instructed users to treat environment variables as compromised and restrict public access to add-ons where enabled. Environment variables can hold API keys, database passwords, and other application credentials.

Similar exposure concerns surfaced in the recent Railway security incident, where customers were also advised to replace stored secrets after possible unauthorized access.

Northflank said the reported activity may fit a wider pattern of attacks targeting AI credentials. It pointed to similar IP addresses in Wiz’s “Black October” report, which described incidents across nine AI developer platforms during October.

Wiz found a shared focus on stored environment variables but identified no single vulnerability connecting the attacks. The financial risk comes from LLMjacking, where attackers use stolen credentials to consume paid AI services at the victim’s expense.

Previous reporting on LLMjacking attacks shows how compromised cloud keys can support unauthorized model access and resale. However, Northflank has not published a confirmed loss total or linked its incident to a named resale operation.

Customers should revoke existing credentials through the issuing providers, generate replacements, and update affected Northflank secrets and workloads.

Northflank also asked users to review AI provider usage and billing records for unexpected activity, then report suspicious usage to its support team and the relevant provider.

Secret rotation is now available for PostgreSQL, MongoDB, MySQL, Redis, MinIO, and RabbitMQ add-ons. Northflank also enabled audit logs for all customers, including free users, giving more teams access to records that may help their investigation.

The immediate priority is replacing all potentially exposed credentials, not only AI keys already showing abuse. Northflank’s latest guidance still covers secrets across workloads, shared secret groups, and global settings while its investigation remains open.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.