Northflank tells every customer to assume their secrets were decrypted

Northflank is a cloud platform developers use to run apps, databases and AI workloads without managing servers themselves. On October 30, 2026, it told customers to assume that every environment variable stored on the platform had been decrypted, and to replace every secret in them. Environment variables are where many apps keep API keys and database passwords. If you don’t run anything on Northflank, this doesn’t apply to you directly.

What happened

Northflank’s incident page says it received a threat alert from the security company Wiz at 11:43 UTC on October 30, reviewed it a minute later and deployed a series of patches that morning. Its updates that day, in order:

• “Rotate environment variables immediately.”
• “Assume all environment variables have been decrypted. Disable/rotate all keys.”
• “Multiple users are confirming that their AI keys have been used.”
• Later that day: “Users have reported unauthorised use of AI API keys supplied to the Northflank platform.”

Since then, Northflank has turned on audit logs for all customers, free accounts included, and made secret rotation available for its Postgres, MongoDB, MySQL, Redis, MinIO and RabbitMQ add-ons. The incident was still open when this was written.

Northflank hasn’t said how the attacker got in or how many customers are affected, BleepingComputer notes.

Part of a pattern this month

Wiz published a report the same day, “Black October” for AI Developer Platforms, listing at least nine AI developer platforms that disclosed incidents in October 2026, including Railway, OpenCode, Zeabur, Warp and now Northflank. Wiz says the public reports point to attackers hunting stored environment variables, especially ones that give access to AI services, and then reselling or running up that access. It says it hasn’t confirmed that one group is behind all of them.

If you use Northflank

1. Rotate every secret you stored there, in workloads, secret groups and global secrets. Revoke the old credential with the provider that issued it, create a new one and update Northflank. Changing the value in Northflank alone doesn’t stop the old key from working.
2. Check your AI provider usage and billing. Northflank asks customers to look for unexpected activity and report it to both Northflank support and the provider.
3. Rotate database add-on credentials with the rotation option Northflank added, and turn off public access to add-ons if you had it on.
4. Read your new audit logs for actions you don’t recognize.
5. Set spending limits or alerts with your AI providers where they offer them, so a stolen key can’t quietly run up a large bill.

How Frame helps

Frame keeps a catalog of known breaches. Add the ones you were part of to a verified email and Frame shows what each exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame never collects or stores the leaked records themselves.

Sources

• Northflank, Security incident, status page updates from October 30 and 31, 2026
• Wiz, “Black October” for AI Developer Platforms, October 30, 2026
• BleepingComputer, Northflank security breach leads to abuse of customers’ AI API keys, October 31, 2026