Northflank breach: rotate every secret stored as an environment variable

Northflank told customers on October 30, 2026 to treat every environment variable on the platform as decrypted. Cloud security firm Wiz raised the alert. Within hours, Northflank’s own updates said users had reported unauthorized use of AI API keys that customers had supplied to the service. The company has not published how the intruders got in, how many tenants were hit, or whether other credential classes left with the same haul. The instruction that matters is already public: disable and rotate the keys.

Northflank is a cloud application platform. Teams store database passwords, cloud tokens, and model-provider keys as environment variables and secret groups so containers and add-ons can start without a human pasting a string. That convenience is why a platform breach becomes a customer incident. A stolen AI key is not a curiosity. It is a bill on someone else’s account, or a resale of model access under a brand that never authorized the call.

What Northflank has confirmed

The published timeline starts at 11:43 UTC on October 30, when Wiz warned the company. Engineers were reviewing a minute later. Network policy patches followed, including further changes at 12:50 UTC and 13:05 UTC. Northflank asked Wiz for incident-response help. Later updates told customers to assume decryption of environment variables, and confirmed reports of AI API key abuse.

As remediation, the company enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis, and turned on audit logs for all customers, including free accounts. It still asks tenants to rotate secrets in workloads, secret groups, and global secrets, and to shut off public access to add-ons where that was left open. Those are customer actions. A vendor patch on the platform does not revoke a key at OpenAI, Anthropic, Amazon Bedrock, or whatever provider the tenant wired in.

LLMJacking is the business model

Wiz’s “Black October for AI Developer Platforms” note ties Northflank into a month of incidents across developer platforms that hold model credentials, including Railway, OpenCode, Warp, and Lightning AI. The researchers describe LLMJacking: stolen provider keys used to run inference on someone else’s bill, sometimes at volume large enough to matter on a finance dashboard. In two cases Wiz investigated, compromised enterprise credentials drove roughly 2.5 million Amazon Bedrock calls and about $100,000 in usage. Wiz has not claimed one actor for every October case. The shared prize is the same class of secret.

Platforms that host AI apps are attractive because the valuable string is already sitting next to the workload. Defenders should treat an AI API key like a cloud root credential for billing and data the model can reach, not like a development convenience.

What to do today

Rotate every user-provided secret that lived on Northflank: model keys, database passwords, cloud tokens, webhook secrets, and anything else in environment variables or secret groups. Do it at the provider, not only in the Northflank UI. Then revoke the old values. A rotated string that still works at the provider is not rotated.

Review AI provider usage and billing for the October window. Look for sudden token volume, new regions, new models, or spend that does not match the team’s schedule. Report suspicious use to Northflank and to the provider. Pull the newly available audit logs before retention arguments start.

Disable public reachability on add-ons that do not need it. Inventory which other SaaS products hold the same class of secret in plain environment variables. The next disclosure will name a different logo. The control is the same: short-lived credentials, scoped keys, alerts on spend, and an assumption that a hosting platform can lose the envelope that wraps your secrets.

Northflank’s silence on root cause does not change the customer job. The keys that were stored there should already be dead.

This briefing relies on public reporting by BleepingComputer and on Northflank’s and Wiz’s published incident notes. It does not include intrusion steps.