Networking - Major outage
Networking
Certificates - Major outage
Services - Major outage
Addons - Major outage
Jobs - Major outage
Builds - Major outage
Logs and Metrics - Major outage
Logs and Metrics
Northflank App - Operational
Northflank API - Operational
Marketing Site - Operational
Documentation - Operational
Notice history
View current statusOct 2026
- Update · UTC
We have enabled audit logs for all customers, including free users.
- Update · UTC
Users have reported unauthorised use of AI API keys supplied to the Northflank platform.
If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately. Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank. Review your AI provider usage and billing logs for unexpected activity, and report any suspicious usage to Northflank support and the relevant provider.
These reports may be consistent with the broader pattern of attacks targeting AI credentials. Similar IP addresses are contained in this article Wiz’s “Black October” report.
- Update · UTC
Our investigation is ongoing. We have no further confirmed findings to share at this time.
Our guidance remains unchanged: assume all environment variables have been compromised and rotate all secrets and credentials immediately, including those in workloads, secret groups and global secrets. Disable public access to addons where enabled.
We will share further updates as more information is confirmed. - Update · UTC
Secret rotation on Postgres and MongoDB has been enabled for all users. We recommend disabling public expose on addons if you have enabled that.
All users should assume their environment variables are decrypted and begin rotation immediately.
Secrets on workloadsSecret groups
Global secrets
Multiple users are confirming that their AI keys have been used.
- Identified · UTC
Assume all environment variables have been decrypted. Disable/rotate all keys.
- Investigating · UTC
Rotate environment variables immediately.
11:43 UTC: Wiz threat alert
11:44 UTC: Northflank engineers review the alert
12:02 UTC: Initial network policy patch
12:50 UTC: Additional patching deployed13:00 UTC: Wiz CIRT support requested
13:05 UTC: Additional patching deployed
13:05 UTC: Additional patching deployed
- Resolved · UTC
This incident has been resolved.
- Monitoring · UTC
Services are operating normally, and we are monitoring the situation.
- Investigating · UTC
The incident has expanded to our core control plane services, affecting login and control plane components. We are working to mitigate the impact. Existing user workloads deployed are unaffected.
- Monitoring · UTC
We have moved the affected parts of the logging and metric components to a different zone. We will continue to monitor the situation.
A public Google status page is now available: https://status.cloud.google.com/incidents/Xs2XTHzAVC9YnafnPyzj
- Identified · UTC
Availability zone b in GCP europe-west2 is experiencing issues with VM to VM communication impacting parts of the platform. We are working on mitigating the impact. The majority of users and system components are unaffeced.