Northflank says assume all environment variables were decrypted; AI key misuse reported, no route or count

Two hours fifteen minutes from alert to "assume everything was decrypted"

Northflank's own incident page puts a threat alert from Wiz at 11:43 UTC on Friday 30 October 2026, and its instruction to "assume all environment variables have been decrypted" at 13:58 UTC. That is 2 hours 15 minutes later (derived from the page's own times). It is the one checkable interval in a thin record, and it measures how fast the company escalated its advice. It does not measure how long anyone had access, how many customers were affected or how the intruder got in, because the page states none of those.

This briefing reads Northflank's status page directly, not press coverage of it. The page was read at 20:03 UTC on Saturday 31 October 2026, again at 20:09 and a last time at 20:15, and its history feed supplied the update times to the second. Wiz's report was read in full on wiz.io. BleepingComputer's article of 31 October was read at 20:14 UTC, and a copy read separately in a browser matched it. It is a secondary source, used only for what it adds and for what Northflank has not answered. Everything below is as of those reads. The incident is open, and a later notice can change any line.

Northflank is a hosting platform. BleepingComputer calls it a "cloud application hosting platform" for deploying and managing applications, containers, databases and AI applications, its own site lists deployments, preview environments, GPU workloads, sandboxes and cloud agents, and its status page lists addons, which the incident updates tie to Postgres, MongoDB, MySQL and Redis. Two interests should be stated plainly. Northflank sells the platform and has a commercial interest in how the incident is described, and its page is the main record. Wiz sells cloud security products, raised the alert, was asked for incident response help (the timeline says so) and wrote the report that Northflank links to.

Northflank has told every customer to assume all environment variables were decrypted and to rotate all of their secrets, and says users report their AI API keys being used by someone else. That much is on the page. The sections below set out what the page establishes, what it does not, what Wiz's report does and does not add, and what a customer should do in what order.

What the page says, update by update

The incident is titled "Security incident" and has seven dated updates, from 13:40 UTC on 30 October to 13:34 UTC on 31 October. The table gives each one, in the page's own words where short, with the interval after the Wiz alert (derived from the 11:43 alert time).

Read the verbs. At 13:58 the instruction is to assume decryption, which is advice under uncertainty, not a finding. At 19:28 the page says it has no further confirmed findings and changes the word to "compromised". BleepingComputer writes that Northflank told customers to assume secrets were decrypted "and that the secrets stored within them were stolen". The page read for this briefing says assume decrypted, and then assume compromised. It does not say stolen. The only confirmed harm on the page is the reported use of AI API keys, first as "multiple users" confirming it at 15:12 and then as users having reported it at 23:38. No number appears for either.

What "Major outage" on the page does and does not say

The page header reads "Experiencing partial outage". The incident is shown as Identified with a Major outage label, and seven components (Networking, Certificates, Services, Addons, Jobs, Builds, and Logs and Metrics) are shown as Major outage, while the app, the API, the marketing site and the documentation are shown as Operational. The incident's own page says "Major outage from 1:40 PM to 12:00 AM".

None of the seven updates says that customer workloads were down, that deployments failed or that any service was unavailable. They are all about secrets. A status product attaches an impact label to an incident and its components, and this page does not explain what was set or why. So the page does not establish that customer workloads were down, and this briefing does not claim it. It also does not establish that they were up. The point for a reader is that outage vocabulary on a secrets incident is a label, and a label is not evidence about availability or about exposure.

Five dates kept apart

A breach record has several different dates, and the page supplies some of them and not others. The table keeps them separate, and the diagram below places the stated ones on a line with the missing one marked.

Zoom

Stated and not stated: the record, line by line

Records, accounts and people are different things, and exposure, retrieval and misuse are different events. The page says "decrypted" and then "compromised", and some coverage says "stolen". The table sets out which is which.

Zoom

What Wiz's report says about Northflank, and what it does not

Northflank's 23:38 update says its reports of AI key misuse "may be consistent with the broader pattern of attacks targeting AI credentials" and that "Similar IP addresses are contained in this article", linking Wiz's "Black October" report. Wiz's report, dated 30 October 2026, says "At least nine AI Developer Platforms have disclosed incidents over the course of the month" and lists nine: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank, the last dated 30 October. That list is the whole of what the report says about Northflank. It gives Northflank no section, no timeline and no indicator.

The report's four listed IP addresses come with Wiz's own limit: it says it does not have evidence linking them directly to the Black October attacks it describes. None is labelled as Northflank's. So the sentence about similar addresses cannot be checked from anything public: whatever addresses Northflank saw are not published, and the ones Wiz published are not tied to the incident. This is not a claim that the sentence is wrong. It is a claim that a reader cannot confirm it. Wiz also says "most of these security incidents are still being analyzed", and "there is no single vulnerability or dependency linking these attacks". The link between the incidents is an inference by two interested parties, not an established common actor, and BleepingComputer says Wiz has not confirmed that one group is behind all nine.

The two cases that carry Wiz's headline figures are not Northflank's, as far as the report says. It describes two Amazon Bedrock keys, about 800,000 calls on one over thirty hours and about 1.7 million on the other over thirteen hours, roughly 2.5 million together (derived), and likely over 100,000 dollars at list price. Wiz says only that these are keys "whose compromise we can attribute to one of these vendor breaches", and does not name the vendor. Because Northflank's access window is not stated, timing alone cannot rule Northflank in or out, and Wiz does not link them. BleepingComputer mentions the two cases in its paragraph on the Wiz report, straight after its account of Northflank's breach, and a reader could take them as Northflank's. The Wiz report does not.

Other briefings on this site cover three of the incidents on Wiz's list. Railway reported that up to about 100,000 workspaces may have had variables exposed, a ceiling not a victim count. OpenCode said provider keys saved by 1.4 percent of its Console users may be exposed, with the instruction to revoke them at the provider. Warp said a vendor in its infrastructure was exploited and that roughly 1 percent of users may be affected. Each is a different company with a different record, and none establishes how Northflank was entered.

Four labels that do the work of a control

Rotated is not revoked. Northflank's own instruction at 23:38 UTC reads: "Revoke existing credentials with their issuing providers", then generate replacements and update the secrets and workloads. Changing a value inside the platform does not cancel the old key at the AI or cloud provider that issued it. The old key keeps working there until the issuer revokes it.

Rotation is not always revocation even for the databases. Northflank's API documentation for addon rotation says new credentials are created with the same permissions and that "the old credentials remain valid until the rotation is finalised". It says MySQL keeps old passwords until finalised, and that Redis completes in one step with the old credentials revoked. The page read does not say how Postgres and MongoDB differ. On that documentation, a customer who started a MySQL rotation and did not finish it still has the old password live.

"Audit logs enabled" is a start, not a record. The 01:04 update says logs are on for all customers, free users included. Northflank's documentation says: "New sinks do not export earlier audit events." It does not, in the page read, say how far back the built in log reaches or whether events from before 01:04 UTC on 31 October exist for a free account. The access window is unknown, so the log that would cover it may not exist.

"Operational" and "Major outage" describe components, not exposure. The app and API are shown as Operational while the incident concerns secrets the platform holds, and the outage label does not say workloads were down. Neither word tells a customer whether their credentials were taken.

What a customer should do, in order

The order follows Northflank's own steps where it gave them and marks where this site is adding something the company did not say. The company's instruction at 15:12 was to begin rotation immediately.

Technical details

Northflank's page prints no indicators, no hashes, no addresses and no entry route, so there is nothing of that kind to list for the incident itself. What it and its documentation do print is below, copied as published and read on 31 October 2026. Each block is explained in plain words above it. Nothing here is a method of attack.

The incident timeline. This is the list at the foot of the incident, as printed. It is the company's own timeline of its response. The 13:05 line appears twice on the page, and it is copied twice.

11:43 UTC: Wiz threat alert
11:44 UTC: Northflank engineers review the alert
12:02 UTC: Initial network policy patch
12:50 UTC: Additional patching deployed
13:00 UTC: Wiz CIRT support requested
13:05 UTC: Additional patching deployed
13:05 UTC: Additional patching deployed

The update wording. These are the key sentences of each update, copied as printed, with the status the page gives each. The guidance moves from rotate, to assume decrypted, to assume compromised. A defender should keep a dated copy of the page, because it is the only record.

30 Oct 13:40 UTC  Investigating  Rotate environment variables immediately.
30 Oct 13:58 UTC  Identified     Assume all environment variables have been decrypted. Disable/rotate all keys.
30 Oct 15:12 UTC  Identified     Multiple users are confirming that their AI keys have been used.
30 Oct 19:28 UTC  Identified     We have no further confirmed findings to share at this time.
30 Oct 23:38 UTC  Identified     Users have reported unauthorised use of AI API keys supplied to the Northflank platform.
31 Oct 01:04 UTC  Identified     We have enabled audit logs for all customers, including free users.
31 Oct 13:34 UTC  Identified     Secret rotation for MySQL and Redis is now available to all customers.

Rotating addon credentials. The documentation for the rotation Northflank added describes a start call and an order of operations. The important lines are the ones about the old credentials staying valid. A defender uses this to schedule the finish of each rotation and to redeploy linked services. The route is printed with the placeholders the documentation uses; no token appears.

POST /v1/projects/{projectId}/addons/{addonId}/secret-rotation
POST /v1/teams/{teamId}/projects/{projectId}/addons/{addonId}/secret-rotation
Required permission: Project > Addons > General > Update

New credentials are created with the same permissions; the old credentials remain valid until the rotation is finalised.
Both MySQL modes retain old passwords until finalised.
Redis instead performs a full restart and completes in one step: old credentials are revoked and clients must reconnect with the new password. Redeploy linked services yourself.

What the audit log records. The audit log page lists the event types, the origins that are recorded and the filters. The page gives services.update.secrets as the event for a change to a service's secrets. It does not, in the part read, list an event for reading a secret value, so whether a read would appear in the log is not stated. A defender filters by origin and event type and exports to a sink they control.

services.create
services.update.secrets
template.run
Origins: Northflank UI | Northflank API/CLI | Template runs | Release flow template runs | Preview environment template runs | Version control | Northflank system
Filters: After, Before, Event type, Trigger, User, Origin, Team, Project, Resource type, Resource ID

Addresses Wiz flags, and the limit it puts on them. Wiz prints four addresses used to test stolen keys, and says it has no evidence linking them directly to the Black October attacks it describes. They are not Northflank's. They are defanged here by this site (the last dot is bracketed) and are listed for blocking or hunting in cloud and proxy logs, not as evidence about this incident.

23.106.46[.]239  |  Reported by Zeabur and later used for credential checking  |  10/26 - 10/29
38.246.114[.]118  |  Checked permissions on several stolen keys  |  10/25 - 10/29
104.243.32[.]50  |  Checked permissions on several stolen keys  |  10/19 - 10/30
31.57.201[.]201  |  Identified using multiple stolen keys  |  10/18 - 10/25

A scoping detail from Wiz's cases. Wiz's two Bedrock cases turned on how far the key's policy reached. This is the sentence for each case, copied as printed. A defender reads it as a reason to restrict the model routes a key can use, not as a description of Northflank's incident.

Case A: "The key's policy allowed global.* cross-region inference profiles"
Case B: "the key's policy allowed Bedrock only through us.* cross-region inference profiles, and the pool requested global.*"

The question the page leaves open

Northflank has said what customers should do, and that is a clear and sensible instruction. It has not said what it is protecting them from: how the intruder got in, for how long, and what else was reached. BleepingComputer says it asked and had no reply. Until the company or an independent party answers, every customer is acting on an assumption that the company itself labels as an assumption.

If you cannot see the date your AI keys were first used by someone else, and the provider's logs and the platform's audit log both start after the access began, how would you know which of your credentials was the one that was taken?