Northflank has alerted its clients to rotate all platform secrets after discovering unauthorized use of AI API keys. The company warned that environment variables, which include sensitive information such as API keys and database passwords, may have been exposed across various workloads and settings.
Investigation and Precautionary Measures
Although Northflank is actively investigating the incident, the entry point remains unidentified, and no specific attacker or affected customers have been confirmed. The warning to rotate credentials is a precaution, not an indication of confirmed theft. The initial alert was raised by Wiz at 11:43 UTC on October 30, 2026, which Northflank engineers promptly reviewed, leading to the deployment of a network policy patch shortly thereafter.
Additional patches were applied within the following hour, and Northflank sought assistance from the Wiz incident response team. However, the details of the patches remain unclear, and the method by which attackers accessed customer secrets has not been established.
Impacted Systems and Wider Implications
Customers have been instructed to regard environment variables as potentially compromised, limiting public access to add-ons where necessary. This incident mirrors a similar security breach at Railway, prompting customers to replace stored secrets to prevent unauthorized access. Northflank has indicated that these activities may be part of a larger pattern of attacks targeting AI credentials, as noted in Wiz’s “Black October” report.
While shared IP addresses were identified, no single vulnerability has been found linking the attacks. The financial threat stems from LLMjacking, where attackers misuse credentials to exploit paid AI services without the victim’s knowledge.
Protective Actions and Recommendations
Customers are advised to revoke existing credentials, generate new ones, and update any affected secrets within Northflank’s platform. Reviewing AI provider usage and billing records for unusual activity is also recommended, with any suspicious findings to be reported to Northflank and the respective providers.
Secret rotation capabilities are now available for several add-ons, such as PostgreSQL, MongoDB, and MySQL. Northflank has also enabled audit logs for all users, enhancing visibility into suspicious activities which can aid investigations. The primary focus remains on replacing all potentially compromised credentials, not just those already showing signs of misuse.
In response to these threats, Northflank continues to emphasize the importance of securing sensitive information across all platforms and settings as investigations proceed.
