Northflank breach: rotate API keys after reports of unauthorized use

Northflank customers should replace the credentials they stored on the platform after reports of unauthorized AI API-key use. The company’s incident page tells users to assume their environment variables were compromised and rotate their secrets immediately.⁴ If you run a website or an AI-powered app there, check your provider accounts today.

Reporting checked October 31, 2026. Illustration generated with AI; it does not depict the incident.

Too long; didn’t read?

• Northflank’s warning covers credentials in workloads, secret groups and global secrets.⁴
• Customers have reported misuse of AI API keys. Northflank advises checking usage and billing records.⁴
• Wiz places the incident in a wider wave of attacks on AI development platforms; it has not identified one shared vulnerability.²

What Northflank has confirmed

Northflank has enabled audit logs for free users and secret rotation for four database types. Its investigation remains ongoing; the public updates do not quantify the affected customer total or explain the initial intrusion.¹

Why stored secrets matter

A secret is a value an application needs to keep private. Northflank’s documentation describes secret groups as collections of runtime variables or build arguments inherited by services and jobs. Groups can also contain secret files and linked database-addon values. In plain English, several parts of an app can depend on the same stored settings.³

When checking your setup, make a list of what each group supplies and which services receive it. Northflank lets users restrict groups to particular services, jobs, tags or environments. Its documentation says a group’s scope determines whether values reach a workload during its build, while it runs, or both.³ Use that inventory to plan the replacement work with whoever maintains your app.

The wider AI-key theft problem

Wiz’s October 30 research lists at least nine AI developer platforms that disclosed incidents that month. It describes attackers seeking stored credentials, particularly those granting AI access. The researchers call the resulting misuse LLMjacking: using stolen access to run AI services at someone else’s expense.²

In two enterprise cases connected to a vendor breach, Wiz observed roughly 800,000 and 1.7 million model calls. It estimates those cases could represent more than $100,000 at list prices. These are findings from Wiz’s broader investigation, not a confirmed Northflank loss total. Wiz also says it cannot definitively link the identified resale operations to the initial intrusions or bulk abuse.²

What customers should do now

1. Revoke and replace stored credentials. Northflank says to do this with the issuing providers, then update affected workloads and secrets.¹
2. Review activity and bills. Report suspicious use to Northflank and the relevant provider. Disable public access to database addons where enabled, as Northflank recommends.¹
3. Apply the new values. Northflank’s documentation says editing a secret group does not restart workloads. Restart dependent services or run jobs again to apply updated runtime variables.³

Keep a checklist of replaced credentials and tested services. Ask your hosting administrator to confirm the work and activity review, then follow the incident page for updates.¹

Sources

1. Northflank, October 30–31, 2026: Security incident updates
2. Wiz, October 30, 2026: “Black October” for AI Developer Platforms
3. Northflank documentation, checked October 31, 2026: Manage secret groups
4. BleepingComputer, October 31, 2026: Northflank security breach leads to abuse of customers’ AI API keys