Brief · Both

Northflank says assume your secrets are gone. Rotate them today.

By alkizz · Oct 31, 2026

If you deploy anything on Northflank, the instruction on its status page is about as blunt as a vendor ever gets: "Assume all environment variables have been decrypted. Disable/rotate all keys." That went up at 9:58 AM ET on Oct 30, and by 11:12 AM ET the page added that "Multiple users are confirming that their AI keys have been used." The advice hasn't softened since, so if you haven't rotated yet, this is the brief where I tell you to stop reading after the What to do list and go do it.

The timeline Northflank posted starts with a "Wiz threat alert" at 7:43 AM ET, then an "Initial network policy patch" at 8:02 AM ET, more patching at 8:50 and 9:05 AM ET, and "Wiz CIRT support requested" at 9:00 AM ET. The first customer-facing line, at 9:40 AM ET, was "Rotate environment variables immediately." So the company found out from a security vendor's alert, patched something network-related within about 20 minutes, and told everyone to rotate within two hours, which is a reasonable response to a bad day, but it still leaves you with the chore.

What's actually confirmed

• Northflank tells every user to treat their environment variables as exposed. At 11:12 AM ET it said "All users should assume their environment variables are decrypted and begin rotation immediately," and listed "Secrets on workloads," "Secret groups" and "Global secrets." At 3:28 PM ET it repeated that its "guidance remains unchanged: assume all environment variables have been compromised and rotate all secrets and credentials immediately, including those in workloads, secret groups and global secrets."
• AI keys were already being abused. At 7:38 PM ET Northflank wrote that "Users have reported unauthorised use of AI API keys supplied to the Northflank platform," and told anyone who hadn't rotated to "Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank."
• It wants you to check your provider bills. The same update says to "Review your AI provider usage and billing logs for unexpected activity, and report any suspicious usage to Northflank support and the relevant provider."
• There are new tools on the Northflank side. "Secret rotation on Postgres and MongoDB has been enabled for all users," Northflank recommends "disabling public expose on addons if you have enabled that," at 9:04 PM ET it said it had "enabled audit logs for all customers, including free users," and at 9:34 AM ET on Oct 31 it added that "Secret rotation for MySQL and Redis is now available to all customers."
• At least one customer has said publicly where it landed. Sentry says it runs only internal and demo or experimental services on Northflank, started rotating secrets and suspending deployments before Northflank's 13:40 UTC (9:40 AM ET) notice, and has found no evidence that customer data or customer-facing services were affected.

What isn't settled

Northflank hasn't said how the attackers got in. The timeline mentions network policy patches, but it doesn't say what was patched, and at 3:28 PM ET the page said "We have no further confirmed findings to share at this time." It also doesn't say how many customers were hit, when the access started, or whether any kind of customer setup is outside the blast radius. The guidance is written for "All users," so until Northflank says otherwise, I'd assume you're in it.

The Wiz link is softer than it might sound in a headline. Northflank wrote that the AI key reports "may be consistent with the broader pattern of attacks targeting AI credentials," and that "Similar IP addresses are contained in" Wiz's report. That's a pointer, not an attribution, and Wiz's own IOC section says of those IPs, "We do not have evidence that links them directly to the “Black October” attacks mentioned in this blog."

Is this Black October again?

Sort of, and this time the name points at something you can actually act on. When the press used "Black October" for the PHP bug week, I called it a patch week with a press agent, and when it turned into a story about IR teams drowning, I checked that too. Wiz's report, by Benjamin Read and Rami McCarthy on Oct 30, uses the name for a run of breaches at AI developer platforms. It counts "At least nine AI Developer Platforms" that disclosed incidents this month and puts Northflank (Oct 30) at the end of the list, after Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp and CommandCode.

Wiz says "there is no single vulnerability or dependency linking these attacks," but that "All public reports highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access." Then it follows two stolen enterprise AI keys from an unnamed compromised vendor (Wiz doesn't say which one, so don't read it as Northflank). The first unauthorized call came "within 30 minutes of the reported credential access," the keys then sat in a low-volume validity check for days, and then the floods started, roughly 800k Bedrock calls over thirty hours on one key and about 1.7 million over thirteen hours on the other. Wiz says "At list price, these two cases alone likely ran up over $100k in usage" and traced testing of the keys to infrastructure tied to overt resale sites. So the business model is simple, and it's your bill.

The score

I'd call it a 4, act this week. Northflank itself says to assume every environment variable was decrypted, users report their AI keys were already used, and in Wiz's two cases from this campaign (an unnamed vendor, not Northflank), stolen keys were tested within 30 minutes and resold within days, so the risk is real money and whatever else those secrets unlock. It isn't a 5 because the fix is fully in your hands, it's rotation rather than waiting on a patch, and Northflank is already telling everyone to do it. If you're a Northflank user and haven't rotated yet, though, don't wait for the week. Do it today.

What to do:

• List every secret you stored in Northflank.

  • Why: Northflank says to rotate secrets "in workloads, secret groups and global secrets," and the one you forget is the one that gets used.
  • How: go through each project's workloads, secret groups and global secrets and write down every variable name and which provider or system issued it. Keep the list to names, not values. Mark the AI provider keys and anything else that can spend money first, then database, cloud, source-control, payment and bot tokens.

• Rotate AI provider keys first.

  • Why: those are the ones Northflank's users report being abused, and Wiz describes AI keys stolen in one of this month's vendor breaches (an unnamed vendor, not Northflank) being tested and resold within days.
  • How: in each provider's console, create a new key, put it in the Northflank secret and redeploy the services that use it. While you're at it, give each service its own key with its own limit, per builders checklist item 2, so the next leak burns one key instead of all of them.

• Revoke the old keys at the provider, not just in Northflank.

  • Why: deleting or overwriting the environment variable doesn't kill the key, and Northflank's own instruction is to "Revoke existing credentials with their issuing providers."
  • How: once the new key is live, delete or revoke the old one in the provider's console. If you want to be sure, make one test call with the old key and confirm it fails.

• Check provider usage and billing for activity you don't recognize.

  • Why: Northflank asks you to "Review your AI provider usage and billing logs for unexpected activity," and in Wiz's two cases (keys from an unnamed vendor, not Northflank), both keys saw a small trickle of check calls for days before the big abuse started.
  • How: open the usage and billing pages for every provider whose key was in Northflank (Anthropic's docs point to the Usage page in the Claude Console) and look back well before Oct 30, since nobody has said when the access started. Look for models you don't use, spikes at odd hours and small steady calls you can't explain. For AWS keys, look for Bedrock model calls and quota lookups you didn't make, since that's what Wiz saw in its unnamed-vendor cases. Report anything odd to Northflank support and the provider, as Northflank asks.

• Set spend caps and alerts.

  • Why: a cap limits the damage from a key you missed, and the abuse in this campaign is billed to you.
  • How: on OpenAI, per its spend limits guide, go to Project settings, select Limits, then Edit spend limit, enter the Monthly spend limit and turn on Enforce a hard limit, and do the same under Organization limits. OpenAI says enforcement "is not instantaneous," so spend can run slightly over. On Anthropic, per its rate limits page, set your own limit in the Spend limits section of the Billing page in the Claude Console, and set per-workspace limits too (you can't set spend limits on the default workspace). On AWS, AWS Budgets sends alerts and can run a budget action, such as applying an IAM policy or SCP, when you cross a threshold, but its data is "updated up to three times a day," so treat it as a delayed alarm, not a hard cap.

• Rotate everything else: databases, cloud credentials and tokens.

  • Why: Northflank's guidance is to "rotate all secrets and credentials immediately," not just the AI ones.
  • How: use the Postgres, MongoDB, MySQL and Redis secret rotation Northflank enabled, and turn off public access on any addon that has it. Then rotate cloud access keys, source-control and CI tokens, payment and webhook secrets, and any chat-bot tokens, which deserve root-password treatment (builders checklist item 3). Where you can, inject secrets at runtime instead of leaving long-lived copies everywhere (builders checklist item 1).

• Keep watching for a few weeks.

  • Why: Wiz saw one stolen key from an unnamed vendor (not Northflank) show up in a reseller pool "Seven days after the initial validation," so a quiet bill today doesn't mean the key wasn't taken.
  • How: check the Northflank audit logs it turned on for all customers, keep your provider spend alerts on, and reload the status page for a root cause. If you're a business with vendors like this, add "how are customer secrets stored, and how will you tell customers if they leak" to your third-party reviews (business checklist item 6).

Sources

• Northflank Status: Security incident (Oct 30-31, 2026)
• Wiz: "Black October" for AI Developer Platforms (Benjamin Read, Rami McCarthy, Oct 30, 2026)
• Sentry Help Center: Was Sentry Customer Data or Services Impacted by the Northflank.com Compromise?
• OpenAI API docs: Spend limits
• Claude API docs: Rate limits (Spend limits section)
• AWS: Managing your costs with AWS Budgets

← All briefs