Summary
- Northflank has instructed customers to assume stored environment variables were exposed.
- Users have reported unauthorised AI API key activity, although the incident's full scope remains under investigation.
- Recovery includes credential rotation, audit-log review, and changes to add-on security controls.
Northflank has instructed customers to rotate credentials stored on its cloud deployment platform following a security incident and reports of unauthorised use of AI service API keys. The company advised users to assume their stored environment variables might have been compromised while it continues investigating the full scope of access.
Environment variables on a deployment platform can hold database passwords, connection strings, authentication tokens, and credentials for external applications. Those values may be attached to individual workloads, shared between applications, or retained in global configuration groups. The same secret can therefore support several services and require coordinated replacement when its confidentiality is in doubt.
Northflank’s published response began on 30 October after an alert from security company Wiz. Engineers started reviewing the warning at 11:44 UTC and applied an initial network policy patch at 12:02 UTC. Additional controls followed, alongside an investigation assisted by Wiz’s incident response specialists.
The company then directed customers to rotate all stored secrets. That precaution reflects uncertainty about the possible exposure of the central secret store; it does not demonstrate that an attacker obtained every value or used every affected credential. Customer reports of unexpected API key activity are evidence of a narrower, observed consequence.
Keys used with commercial AI providers can authorise requests that consume billable services. A leaked token may therefore create financial costs through unauthorised API calls, even when an attacker does not gain control of the application’s principal database or administrative console. Provider-side request records and billing information can help determine whether suspicious activity occurred.
Northflank told customers to revoke credentials at their issuing services, replace the values stored on its platform, and examine third-party logs. Changing only an environment variable would leave the old credential usable if the organisation that issued it continued to accept it. Revocation and application reconfiguration must consequently be treated as connected tasks.
The platform enabled database-secret rotation for PostgreSQL and MongoDB on 30 October and extended support to MySQL and Redis on 31 October. It also made audit logs available for all customer accounts, including the free tier, to assist customers reviewing relevant changes and access events during the investigation.
Rotating a database password differs from replacing a third-party API token. An application may maintain multiple connections to a managed database, so both the server-side password and every dependent workload need updating. An externally issued token must be invalidated with its provider, while new values are deployed to the services that rely on it.
Audit logs provide an additional evidence source but cannot independently establish the full extent of misuse. Platform records may show changes to configuration and account activity, while an AI provider can identify requests made using a particular token. Investigators must reconcile those records to understand whether an exposed credential was actually exercised.
Cloud deployment services reduce the administrative burden of managing multiple environments but concentrate sensitive configuration in a common control plane. A single secret-management concern can affect production systems, testing workloads, payment integrations, data storage, and external APIs, with different teams responsible for the systems requiring credentials to be replaced.
Northflank also advised limiting public access to add-ons where unnecessary. Restricting network reachability can reduce the locations from which a stolen database credential is usable, although it cannot restore the confidentiality of a value already exposed. The company’s broader response therefore combines infrastructure protections with customer-directed credential changes.
Application operators may need to coordinate these changes with maintenance windows and service owners. Removing an old secret before dependent applications accept the replacement can interrupt operations; allowing both old and new values to remain active for too long can prolong exposure. The incident response therefore creates work across security, development, and operations functions.
Northflank continues to investigate the initial access and broader impact while customers rotate credentials and inspect their own services. The status record establishes the controls and recovery facilities delivered to date, but it does not provide a definitive public count of all compromised accounts or a complete reconstruction of the attack.
