Northflank Breach Exposes Customer Secrets and Enables AI API Key Abuse

Northflank disclosed a security incident on October 30, 2026, after Wiz alerted it to unauthorized access to its infrastructure. Attackers decrypted customer environment variables containing sensitive credentials, and several customers reported unauthorized use of AI API keys stored on the platform. A separate account reported that persistent storage containing customer secrets was compromised and that customers were told to assume stored environment variables, connection strings, and build arguments had been decrypted and exfiltrated. The reported AI credential abuse is consistent with LLMJacking, in which attackers consume or resell model access using stolen keys. The initial access vector and number of affected customers remain undisclosed; claims of millions of unauthorized requests across hundreds of organizations are not confirmed in the supplied reporting.

Northflank deployed network-policy patches, disabled public access to add-ons, enabled credential rotation and audit logging, and urged customers to rotate all stored secrets. The separate account reported containment on October 31 after backend storage encryption keys were regenerated and network access boundaries reinforced. Affected organizations should revoke and replace exposed credentials at their issuing providers, rather than only updating values in Northflank, and review provider-side usage, billing, and access logs for abuse. Spending limits and source-IP restrictions can reduce further exposure where supported; replacing long-lived secrets with short-lived workload identities can limit future impact.