Short answer
Northflank said it received a threat alert from Wiz on 30 October 2026 and told customers to assume all environment variables had been decrypted. It later confirmed that users reported unauthorized use of AI API keys stored on the platform. How the attacker got in has not been disclosed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Northflank |
|---|---|
| Incident type | Data breach |
| Status | Under investigation |
| Sector | Cloud hosting and developer platform |
| Country | United Kingdom |
| Detected | 2026-10-30 |
| Disclosed | 2026-10-30 |
| People or records affected | Not disclosed. Northflank advised all customers to act as though they were affected |
What data was exposed
- Environment variables stored on the platform, which Northflank said to assume were decrypted
- Secrets in workloads, secret groups and global secrets, including database credentials and cloud tokens
- AI provider API keys, with multiple customers reporting unauthorized use
What happened
Northflank is a platform for deploying applications, databases and AI workloads. Its status page records a security incident on 30 October 2026. A threat alert from cloud security firm Wiz arrived at 11:43 UTC, engineers reviewed it a minute later, and a first network policy patch followed at 12:02, with further patches at 12:50 and 13:05. Northflank asked Wiz’s incident response team for help.
What customers were told
At 13:58 UTC Northflank wrote: “Assume all environment variables have been decrypted. Disable/rotate all keys.” It later enabled secret rotation for PostgreSQL and MongoDB, and BleepingComputer reports MySQL and Redis were added. It also turned on audit logs for every customer, including free-tier accounts, and advised turning off public access to add-ons.
Environment variables are where developers keep database passwords, cloud credentials, tokens and API keys. If they were read, the risk reaches beyond Northflank to every service those secrets unlock.
AI key abuse
By the afternoon, Northflank said multiple users had confirmed that their AI keys had been used without permission. In a late update it asked users to revoke credentials with their providers, review usage and billing logs, and report suspicious activity. This kind of theft is often called LLMjacking: stolen keys are used to run AI workloads on someone else’s bill or are resold.
What is not known
Northflank has not said how the attacker gained access, how many customers are affected, or whether anything beyond AI keys was misused. BleepingComputer’s requests for comment had not been answered when it published on 31 October. Because of that, the status here is “under investigation” rather than a confirmed scope.
A wider pattern
Northflank’s updates linked the activity to a Wiz report on at least nine incidents at AI developer platforms in October. We covered two of them: Railway and OpenCode Console. We have not independently verified Wiz’s report and rely on BleepingComputer’s description of it.
What to do
Rotate and revoke, in that order, then audit billing. Do not click links in emails that claim to come from Northflank or an AI provider about your keys. Follow our data breach checklist and see how fake security notices work in our phishing guide.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fraudulent AI usage charges on provider accounts, sometimes followed by fake refund or recovery contacts.
- Extortion or intrusion attempts that use leaked database passwords or cloud credentials.
- Phishing emails posing as Northflank or an AI provider asking you to log in to confirm your keys.
What to do if you are affected
- 01Rotate every secret stored on Northflank: workload variables, secret groups and global secrets.
- 02Revoke old credentials with their issuing providers, then generate replacements and update workloads.
- 03Disable public access on database add-ons where it is enabled.
- 04Review AI provider usage and billing logs for spend you did not make, and report it to the provider and to Northflank support.
- 05Turn on and read the audit logs Northflank has enabled, and check other services that shared the exposed secrets.
Frequently asked questions
Did Northflank confirm customer secrets were stolen?
Northflank told customers to assume all environment variables had been decrypted and to rotate all keys. It also said multiple users confirmed their AI keys had been used. It has not published how the attacker got in or how many customers are affected.
What should I do first?
Rotate secrets and revoke the old ones with the issuing providers, starting with AI API keys and cloud credentials. Then check usage and billing for activity you do not recognize.
Is this linked to the Railway and OpenCode incidents?
Northflank's updates pointed to a Wiz report on a cluster of October incidents at AI developer platforms and noted similar IP addresses. Wiz has not confirmed that the same attackers were behind all of them, according to BleepingComputer.
Will Northflank cover fraudulent AI charges?
Northflank's updates tell users to report suspicious usage to both its support and the AI provider. The sources we reviewed do not state a refund policy.
Sources
- Security incident updates, 30 October 2026, Northflank status page, 2026-10-30
- Northflank security breach leads to abuse of customers' AI API keys, BleepingComputer, 2026-10-31
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.