Northflank - Status Page

The platform has remained operational and customer workloads have remained online throughout the incident. At this time, we have found no evidence that customer workloads or workload data were accessed.

The first known decryption of secrets occurred between 02:39 UTC and 03:08 UTC on 30 October. Northflank received its first security platform alert at 11:43 UTC, and our engineers responded within minutes. The exploit was patched within 60 minutes of notification, and customers were notified within two hours.

Intermittent platform degradation occurred during a high volume of simultaneous customer redeployments and during our subsequent key rotation and platform hardening work.

We have worked with upstream providers to revoke credentials where possible.

For users

Please rotate all integration and project secrets if you have not already done so, review provider logs for unusual activity, and enable IP restrictions and budget limits wherever available.

For upstream providers

We strongly recommend providing API endpoints for credential revocation, IP restrictions, and enforceable budget limits. These controls enable faster incident response and help limit the impact of compromised credentials.

Our investigation and independent forensic review remain ongoing. We will share further confirmed findings and a root cause analysis once available.

We believe the attack vector was contained within an hour of the first alert. Our investigation shows no sign that the attacker was in our environment after the attack.

Independent forensic auditors began reviewing the attack together with Northflank over the weekend, and they continue to review it.

Impact on your workloads

Running workloads were unaffected. At this time we have seen no sign that workloads or workload data were accessed during the attack. Evidence suggests it was focused on secrets held in our control plane. Customers on forward-deployed or dedicated control planes are unaffected.

Separately, we have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration. If your BYOC cluster is no longer connected to Northflank, please contact support.

Over the last few days there has been intermittent platform degradation while we rotated our own keys and hardened the platform.

What you need to do

Some customers have reported unauthorised use of AI secrets. Please rotate all secrets now, both integration secrets and project secrets, even if you haven’t seen suspicious activity. We recommend starting with AI provider keys, cloud provider credentials, payment provider keys, private keys, and database and other service credentials.

We also recommend reviewing your provider logs for unusual activity. If you have seen unexpected AI usage or spend, contact your AI providers directly, such as OpenAI and Anthropic.

Where we were able to act on your behalf, we have revoked Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts. If you haven’t already, sign in again and reconnect your integrations.

Need help?

If you need help rotating secrets or checking that everything has been rotated, contact support@northflank.com, or use your direct channel with us if you have one. We are treating this with the utmost urgency, and the entire organisation has been working 24/7.

What’s next

We will keep updating this page as the review progresses, and we intend to share a root cause analysis once we have confirmed findings.

Secret rotation is now available for RabbitMQ add-ons for all customers.

Please rotate all secrets if you have not already.

Secret rotation for Minio Addons is now available to all customers.

Please rotate all secrets if you have not already.

Secret rotation for MySQL and Redis is now available to all customers.

Please rotate all secrets if you have not already.

We have enabled audit logs for all customers, including free users.

Users have reported unauthorised use of AI API keys supplied to the Northflank platform.

If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately. Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank. Review your AI provider usage and billing logs for unexpected activity, and report any suspicious usage to Northflank support and the relevant provider.

These reports may be consistent with the broader pattern of attacks targeting AI credentials. Similar IP addresses are contained in this article Wiz’s “Black October” report.

Our investigation is ongoing. We have no further confirmed findings to share at this time.

Our guidance remains unchanged: assume all environment variables have been compromised and rotate all secrets and credentials immediately, including those in workloads, secret groups and global secrets. Disable public access to addons where enabled.

We will share further updates as more information is confirmed.

Secret rotation on Postgres and MongoDB has been enabled for all users. We recommend disabling public expose on addons if you have enabled that.

All users should assume their environment variables are decrypted and begin rotation immediately.

Secrets on workloads

Secret groups

Global secrets

Multiple users are confirming that their AI keys have been used.

Assume all environment variables have been decrypted. Disable/rotate all keys.